Cloudanix VulnDB

GHSA-69fq-xp46-6x23

Critical · 10.0

Embedded Malicious Code in Trivy binary

CVSS

10.0

EPSS

—

Published

Mar 21, 2026

CISA due date

—

The record

On March 19, 2026, threat actor TeamPCP used compromised credentials to publish a malicious Trivy v0.69.4 release containing a credential-stealing payload. The malware extracts secrets from process memory and filesystem locations including SSH keys, cloud provider credentials, Kubernetes tokens, and environment variables. Stolen data is encrypted using AES-256-CBC with RSA-4096 hybrid encryption and exfiltrated via HTTP POST to attacker infrastructure at scan.aquasecurtiy[.]org (typosquatted domain). As a fallback, stolen GitHub PATs are used to stage data in repositories named tpcp-docs within compromised accounts.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities