Mar 1, 2026

TeamPCP supply-chain campaign: Trivy → Checkmarx GitHub Actions

› Aqua Trivy, trivy-action, setup-trivy, Checkmarx AST/KICS GitHub Actions, related Docker/VS Code artifacts

Threat actors tracked as TeamPCP compromised Trivy releases and GitHub Actions (including trivy-action / setup-trivy), then expanded into Checkmarx AST and KICS Actions and related artifacts. Malware stole CI/CD credentials (exfil as tpcp.tar.gz). Microsoft, Sysdig, CSA Singapore and Checkmarx published guidance in March 2026.