# Aqua Trivy VS Code Extension Supply Chain Compromise — hackerbot-claw AI Bot Campaign, Stolen PAT, OpenVSX Malicious Publish, AI Agent Execution Injection

> An AI-powered autonomous bot (hackerbot-claw) exploited GitHub Actions workflows across 7 major open source repositories between February 21-28, 2026, using 5 distinct exploitation techniques. The campaign resulted in theft of a GitHub PAT from Aqua Security's Trivy repository, which was used to publish malicious versions 1.8.12 and 1.8.13 of the Trivy VS Code extension to OpenVSX. The malicious extensions contained injected code that executed locally-installed AI coding assistants (Claude, Codex, Gemini, Copilot, Kiro) in fully permissive modes to perform system reconnaissance and exfiltrate credentials via GitHub CLI.

- **Published:** 2026-03-02T12:00:00Z
- **Last reviewed:** 2026-03-02T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0165
- **ID:** TL-2026-0165
- **Severity:** HIGH
- **Category:** SUPPLY_CHAIN
- **Status:** SUPERSEDED
- **Detections:** 9 · **IOCs:** 16 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Between February 21 and 28, 2026, a GitHub account called hackerbot-claw — self-described as an 'autonomous security research agent powered by claude-opus-4-5' — conducted a week-long automated attack campaign targeting CI/CD pipelines across major open source repositories. The bot systematically scanned public repositories for exploitable GitHub Actions workflows, using a vulnerability pattern index with 9 classes and 47 sub-patterns.

The campaign targeted 7 repositories: microsoft/ai-discovery-agent, DataDog/datadog-iac-scanner, avelino/awesome-go (140k+ stars), ambient-code/platform, project-akri/akri (CNCF), aquasecurity/trivy, and RustPython/RustPython (20k+ stars). The bot achieved arbitrary code execution in at least 4 targets and exfiltrated a GITHUB_TOKEN with write permissions from awesome-go.

Five distinct exploitation techniques were employed: (1) Pwn Request — pull_request_target workflow exploiting untrusted fork code checkout, injecting Go init() backdoor for token exfiltration via recv.hackmoltrepeat.com. (2) Direct Script Injection — raw curl-pipe-bash payload in version.sh. (3) Branch Name Injection — bash brace expansion and command substitution hidden in git branch names. (4) Filename Injection — Base64-encoded shell commands embedded in filenames processed by vulnerable workflows. (5) AI Prompt Injection — replacing CLAUDE.md project config to manipulate AI code reviewers.

The attack on Aqua Security's Trivy repository resulted in full repository compromise and theft of a personal access token. This stolen PAT was used to publish malicious versions 1.8.12 (Feb 27, 12:04 UTC) and 1.8.13 (Feb 28, 16:28 UTC) of the Trivy VS Code extension to the OpenVSX registry.

The malicious extension versions injected code into the workspace activation function pl(). On activation, the code executed commands targeting 5 AI coding CLIs in their most permissive modes: claude -p --dangerously-skip-permissions --add-dir /, codex exec --ask-for-approval never --sandbox danger-full-access, gemini prompt --yolo --no-stream, copilot --autopilot --yolo, and kiro-cli chat -a --no-interactive. All processes were spawned detached with stdio: 'ignore', making execution invisible to the user.

Version 1.8.12 contained a ~2,000-word prompt disguised as a forensic investigation role assignment, instructing AI agents to collect credentials, financial data, trade secrets, and internal communications, then exfiltrate through every available channel (email, Slack, Teams, ticketing systems). The prompt was engineered to work within AI safety guardrails by framing data theft as compliance-mandated forensic evidence preservation.

Version 1.8.13 contained a focused prompt instructing AI agents to enumerate installed tools, MCP servers, authentication tokens, and filesystem credentials, save findings to REPORT.MD, then use the authenticated gh CLI to create a repository named posture-report-trivy and push the report. The GitHub API defaults to public repository creation, though gh CLI defaults to private.

The exposure window lasted approximately 34 hours. Socket Security identified the malicious versions, contacted Aqua Security and the OpenVSX publisher (a former Aqua employee), who revoked the publishing token and removed affected versions by Feb 28 22:46 UTC. No public posture-report-trivy repositories have been found, suggesting impact was likely minimal. GHSA-8mr6-gf9x-j8qg was published but was itself created by the bot during the incident.

Notably, Claude Code (Sonnet 4) successfully detected and refused the AI prompt injection attack on ambient-code/platform, identifying it as a 'textbook AI agent supply-chain attack via poisoned project-level instructions' and posting detailed security warnings.

## MITRE ATT&CK

- T1195.002 Compromise Software Supply Chain
- T1195.001 Compromise Software Dependencies and Development Tools
- T1059.004 Unix Shell
- T1059.007 JavaScript
- T1204.002 Malicious File
- T1554 Compromise Host Software Binary
- T1036.005 Match Legitimate Resource Name or Location
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1528 Steal Application Access Token
- T1552.001 Credentials In Files
- T1552.004 Private Keys
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1518 Software Discovery
- T1119 Automated Collection
- T1005 Data from Local System
- T1567.002 Exfiltration to Cloud Storage
- T1048 Exfiltration Over Alternative Protocol
- T1071.001 Web Protocols
- T1195 Supply Chain Compromise

## Sources

- [Socket Security — Unauthorized AI Agent Execution Code Published to OpenVSX in Aqua Trivy VS Code Extension](https://socket.dev/blog/unauthorized-ai-agent-execution-code-published-to-openvsx-in-aqua-trivy-vs-code-extension)
- [StepSecurity — hackerbot-claw: AI-Powered Bot Exploiting GitHub Actions](https://www.stepsecurity.io/blog/hackerbot-claw-github-actions-exploitation)
- [GHSA-8mr6-gf9x-j8qg — Malicious Trivy OpenVSX Extension Release](https://github.com/aquasecurity/trivy-vscode-extension/security/advisories/GHSA-8mr6-gf9x-j8qg)
- [hackerbot-claw GitHub Account](https://github.com/hackerbot-claw)
- [awesome-go PR #6069 — Token Exfiltration via Go init() Backdoor](https://github.com/avelino/awesome-go/pull/6069)
- [Akri PR #783 — Direct Script Injection Attack](https://github.com/project-akri/akri/pull/783)
- [Microsoft ai-discovery-agent PR #236 — Branch Name Injection](https://github.com/microsoft/ai-discovery-agent/pull/236)
- [DataDog PR #7 — Filename Injection Attack](https://github.com/DataDog/datadog-iac-scanner/pull/7)
- [ambient-code PR #732 — AI Prompt Injection via CLAUDE.md](https://github.com/ambient-code/platform/pull/732)
- [Socket Security OpenVSX Package Analysis — Trivy 1.8.12](https://socket.dev/openvsx/package/aquasecurityofficial.trivy-vulnerability-scanner/overview/1.8.12)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0165