Cybersecurity Alert: Major Malware Attack on Aqua Security Exposes Developer Environments
On March 22, 2026, a significant malware attack targeted Aqua Security, a well-known cloud security provider. Cybersecurity researchers discovered malicious versions of Trivy, an open-source vulnerability scanner, on Docker Hub, following a supply chain compromise. The affected versions (0.69.4, 0.69.5, and 0.69.6) were found to contain a credential-stealing malware linked to a threat actor named TeamPCP.
The attack has impacted dozens of npm packages, enabling the spread of a self-propagating worm known as CanisterWorm. Additionally, all 44 internal repositories associated with Aqua’s GitHub organization were defaced, revealing sensitive proprietary code.
To protect against similar threats, organizations should review their use of Trivy, avoid affected versions, and treat recent executions as potentially compromised.
Risk Level: High
Source: View Original Report
