Trivy Ecosystem Supply Chain Compromise — Infostealer via Hijacked GitHub Actions and Container Images (CWE-506)
Trivy Ecosystem Supply Chain Compromise (TL-2026-0263), also tracked as GHSA-69fq-xp46-6x23, is a critical-severity supply-chain compromise, first published 2026-03-21. It is attributed to TeamPCP (Russia) with low confidence, affects Aqua Security trivy, maps to 13 MITRE ATT&CK techniques (T1003, T1005, T1036), and is covered by 9 detection rules and 15 indicators of compromise.
Key facts for TL-2026-0263
- Threat ID
- TL-2026-0263
- Also known as
- GHSA-69fq-xp46-6x23, Trivy Supply Chain Attack March 2026
- Severity
- CRITICAL
- Status
- MONITORING
- Category
- SUPPLY_CHAIN
- First published
- 2026-03-21
- Last reviewed
- 2026-03-21
- Attribution
- TeamPCP
- Attribution confidence
- LOW
- Nation-state nexus
- Russia
- Motivation
- UNKNOWN
- Target sectors
- technology, financial, government, healthcare, critical-infrastructure, cloud-services
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 15
Malware and tooling in Trivy Ecosystem Supply Chain Compromise
Malware and tooling: Cosign, Docker, GitHub Actions, Sigstore, Trivy
A threat actor exploited a non-atomic credential rotation to hijack the Trivy security scanner ecosystem on March 19, 2026, publishing a malicious v0.69.4 release and force-pushing infostealer payloads to 76 of 77 trivy-action tags and all 7 setup-trivy tags. The malicious code dumped CI runner process memory, harvested secrets from 50+ filesystem paths, encrypted data via AES-256-CBC/RSA-4096, and exfiltrated to attacker infrastructure with a fallback dead-drop mechanism using public GitHub repositories.
How Trivy Ecosystem Supply Chain Compromise works
On March 19, 2026, a threat actor launched a devastating second-wave supply chain attack against the Aqua Security Trivy ecosystem, one of the most widely-used open-source vulnerability scanners in the container security space. The attack exploited a critical operational security failure: a non-atomic credential rotation performed on March 1, 2026, in response to an initial compromise discovered in February 2026. During the multi-day rotation window, the attacker was able to exfiltrate the newly rotated credentials before the rotation completed, maintaining persistent access.
The attack targeted three components simultaneously. First, the attacker pushed malicious commit 1885610c to the trivy repository, which replaced the legitimate actions/checkout reference (SHA de0fac2e4500dabe0009e67214ff5f5447ce83dd) with an imposter composite action at commit 70379aad1a8b40919ce8b382d3cd7d0315cde1d0. This imposter action downloaded malware from a typosquatted domain. The commit also injected --skip=validate into the goreleaser configuration, bypassing binary validation checks. Cosmetic changes (quote standardization, whitespace normalization) were used to disguise the malicious modifications. The resulting v0.69.4 release was distributed across GHCR, ECR Public, Docker Hub, Homebrew, deb/rpm packages, and get.trivy.dev.
Second, the attacker force-pushed 76 of 77 trivy-action version tags (v0.0.1 through v0.34.2) to malicious commits. The injected payload modified entrypoint.sh to execute an infostealer before the legitimate scan. Third, all 7 setup-trivy tags (v0.2.0 through v0.2.6) were force-pushed with identical infostealer code injected into action.yaml as a Setup environment step.
The infostealer payload was sophisticated. It targeted the Runner.Worker process, dumping its memory via /proc/<pid>/mem to extract runtime secrets. It then scanned 50+ filesystem paths harvesting SSH keys, AWS/GCP/Azure credentials, Kubernetes tokens and kubeconfig files, Docker configuration and registry credentials, .env files, database credentials, CI/CD platform tokens, and cryptocurrency wallet keys. Harvested data was encrypted using AES-256-CBC symmetric encryption with the symmetric key itself encrypted via RSA-4096 public key cryptography, forming a hybrid encryption scheme. Primary exfiltration occurred to attacker-controlled infrastructure. As a fallback mechanism, the malware created public repositories named tpcp-docs under the victim organization and uploaded encrypted stolen data as release assets.
The exposure windows varied by component: trivy v0.69.4 was exposed for approximately 3 hours (18:22 to 21:42 UTC), trivy-action for approximately 12 hours (17:43 UTC March 19 to 05:40 UTC March 20), and setup-trivy for approximately 4 hours (17:43 to 21:44 UTC). Any CI/CD pipeline that executed during these windows using mutable version tags was potentially compromised.
This attack represents a significant evolution in supply chain threats targeting developer security tooling, specifically exploiting the trust relationship between security scanners and CI/CD pipelines to harvest credentials at scale.
MITRE ATT&CK techniques used in TL-2026-0263
credential-access
T1003 OS Credential Dumping; T1552 Unsecured Credentials
collection
T1005 Data from Local System; T1119 Automated Collection
defense-evasion
exfiltration
T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service
execution
T1059 Command and Scripting Interpreter; T1204 User Execution
initial-access
defense-impairment
resource-development
Affected products and versions in Trivy Ecosystem Supply Chain Compromise
- Aqua Security — trivy
Vulnerable versions: 0.69.4
Fixed in: 0.69.3 - Aqua Security — trivy-action (GitHub Actions)
Vulnerable versions: 0.0.1 through 0.34.2 (76 of 77 tags)
Fixed in: 0.35.0 - Aqua Security — setup-trivy (GitHub Actions)
Vulnerable versions: 0.2.0 through 0.2.6 (all 7 tags)
Fixed in: 0.2.6 (recreated)
Remediation for Trivy Ecosystem Supply Chain Compromise
Patches
- trivy v0.69.3 (safe, immutable release from March 3, 2026)
- trivy-action v0.35.0 (safe, immutable release from March 4, 2026)
- setup-trivy v0.2.6 (recreated, safe version)
Immediate actions
- Update trivy to v0.69.3 or earlier — do NOT use v0.69.4
- Update trivy-action to v0.35.0 (immutable release)
- Update setup-trivy to v0.2.6 (recreated immutable release)
- Rotate ALL secrets potentially exposed during the exposure window (March 19-20, 2026)
- Audit all CI/CD workflow runs from March 19-20, 2026 for use of affected mutable version tags
- Search GitHub organization for tpcp-docs repositories indicating successful fallback exfiltration
- Revoke and reissue SSH keys, cloud credentials, API tokens, and service account keys
Workarounds
- Pin trivy-action to immutable commit SHA instead of version tag
- Pull container images by digest instead of tag
- Use cosign to verify container image signatures before use
- Temporarily disable trivy-action in CI pipelines until verified safe version is deployed
Longer-term hardening
- Pin ALL GitHub Actions to full commit SHA hashes instead of mutable version tags
- Implement GitHub Actions allow-listing to restrict which actions can execute in workflows
- Deploy Sigstore cosign verification for all container image pulls
- Verify binary integrity using cosign sigstore bundles before deployment
- Implement runtime monitoring for unexpected process memory access via /proc/*/mem
- Enforce atomic credential rotation procedures with immediate invalidation of old credentials
- Monitor for typosquatted domains targeting CI/CD tool supply chains
Weaknesses (CWE) in Trivy Ecosystem Supply Chain Compromise
CWE-506
Timeline of Trivy Ecosystem Supply Chain Compromise
- Initial supply chain attack against Trivy ecosystem began; threat actor gained initial access to Aqua Security infrastructure
- GHSA-9p44-j4g5-cfx5 published — script injection via sourced env file in trivy-action composite action, a moderate severity precursor vulnerability
- Initial compromise disclosed; Aqua Security performed credential rotation, but rotation was non-atomic (spanning multiple days), allowing attacker to exfiltrate newly rotated credentials
- GitHub immutable releases enabled for trivy repository; v0.69.3 released as safe immutable version with cosign signatures
- Immutable releases enabled for trivy-action; v0.35.0 released as safe immutable version
- 21:42 UTC — Trivy v0.69.4 exposure window closed (~3 hours). 21:44 UTC — setup-trivy exposure window closed (~4 hours)
- 18:22 UTC — Malicious trivy v0.69.4 published across GHCR, ECR Public, Docker Hub, Homebrew, deb/rpm, and get.trivy.dev with goreleaser --skip=validate bypassing binary validation
- 17:43 UTC — Second attack wave launched. Attacker pushed malicious commit 1885610c to trivy repo and force-pushed 76 trivy-action tags and all 7 setup-trivy tags with infostealer payloads
- 05:40 UTC — trivy-action exposure window closed (~12 hours). All malicious tags reverted or replaced
- GHSA-69fq-xp46-6x23 security advisory published with full technical details, IOCs, and remediation guidance
- As of 2026-05-29, the specific Trivy v0.69.4/trivy-action/setup-trivy artifacts are remediated (immutable releases v0.69.3/v0.35.0/v0.2.6, exposure windows closed Mar 20, GHSA-69fq-xp46-6x23 published), so no live malicious package remains. However TeamPCP (UNC6780) is highly active with escalating successor waves through May 18-20 (GitHub breach, Megalodon, TanStack, Bitwarden), and credentials stolen in the exposure window stay valid until rotated, warranting continued monitoring.
Sources cited for Trivy Ecosystem Supply Chain Compromise
- GHSA-69fq-xp46-6x23 — Trivy Ecosystem Supply Chain Compromise
- Aqua Security Blog — Trivy Supply Chain Attack: What Happened and What You Need to Know
- Malicious Commit 1885610c — trivy repository
- GHSA-9p44-j4g5-cfx5 — Script Injection via Sourced Env File (Preceding Advisory)
- Trivy v0.69.3 Safe Release (Immutable)
- Aqua Security Trivy GitHub Repository
- Aqua Security trivy-action GitHub Repository
- CWE-506: Embedded Malicious Code
Threats related to Trivy Ecosystem Supply Chain Compromise
- Trivy Supply Chain Compromise by TeamPCP — Credential-Stealing Malware in v0.69.4, trivy-action, and setup-trivy GitHub Actions
- Checkmarx KICS GitHub Action Supply Chain Compromise by TeamPCP (kics-github-action Tag Hijacking)
- Trivy Supply Chain Attack — Credential Theft Infostealer via Malicious GitHub Actions Tags (GHSA-69fq-xp46-6x23)
- TeamPCP Cascading Supply Chain Campaign: Telnyx PyPI Compromise with WAV Steganography
- Trivy Supply Chain Compromise — TeamPCP Credential-Stealing Malware Injected into CI/CD Pipelines (CVE-2026-33634)
- TeamPCP Partners With Vect Ransomware Group to Escalate Cross-Ecosystem Open Source Supply Chain Attacks
Detection coverage for TL-2026-0263
As of 2026-03-21, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0263 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.