The Trivy Supply Chain Compromise: Technical Breakdown and Pipeline Hardening Playbook

Executive Summary Threat actor: TeamPCP Compromise date: March 19, 2026 (active campaign through March 24+) Tool compromised: aquasecurity/trivy-action, aquasecurity/setup-trivy, Trivy binary v0.69.4