# Trivy Ecosystem Supply Chain Compromise — Infostealer via Hijacked GitHub Actions and Container Images (CWE-506)

> A threat actor exploited a non-atomic credential rotation to hijack the Trivy security scanner ecosystem on March 19, 2026, publishing a malicious v0.69.4 release and force-pushing infostealer payloads to 76 of 77 trivy-action tags and all 7 setup-trivy tags. The malicious code dumped CI runner process memory, harvested secrets from 50+ filesystem paths, encrypted data via AES-256-CBC/RSA-4096, and exfiltrated to attacker infrastructure with a fallback dead-drop mechanism using public GitHub repositories.

- **Published:** 2026-03-21T12:00:00Z
- **Last reviewed:** 2026-03-21T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0263
- **ID:** TL-2026-0263
- **Severity:** CRITICAL
- **Category:** SUPPLY_CHAIN
- **Status:** MONITORING
- **Actor:** TeamPCP (Russia)
- **Detections:** 9 · **IOCs:** 15 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On March 19, 2026, a threat actor launched a devastating second-wave supply chain attack against the Aqua Security Trivy ecosystem, one of the most widely-used open-source vulnerability scanners in the container security space. The attack exploited a critical operational security failure: a non-atomic credential rotation performed on March 1, 2026, in response to an initial compromise discovered in February 2026. During the multi-day rotation window, the attacker was able to exfiltrate the newly rotated credentials before the rotation completed, maintaining persistent access.

The attack targeted three components simultaneously. First, the attacker pushed malicious commit 1885610c to the trivy repository, which replaced the legitimate actions/checkout reference (SHA de0fac2e4500dabe0009e67214ff5f5447ce83dd) with an imposter composite action at commit 70379aad1a8b40919ce8b382d3cd7d0315cde1d0. This imposter action downloaded malware from a typosquatted domain. The commit also injected --skip=validate into the goreleaser configuration, bypassing binary validation checks. Cosmetic changes (quote standardization, whitespace normalization) were used to disguise the malicious modifications. The resulting v0.69.4 release was distributed across GHCR, ECR Public, Docker Hub, Homebrew, deb/rpm packages, and get.trivy.dev.

Second, the attacker force-pushed 76 of 77 trivy-action version tags (v0.0.1 through v0.34.2) to malicious commits. The injected payload modified entrypoint.sh to execute an infostealer before the legitimate scan. Third, all 7 setup-trivy tags (v0.2.0 through v0.2.6) were force-pushed with identical infostealer code injected into action.yaml as a Setup environment step.

The infostealer payload was sophisticated. It targeted the Runner.Worker process, dumping its memory via /proc/<pid>/mem to extract runtime secrets. It then scanned 50+ filesystem paths harvesting SSH keys, AWS/GCP/Azure credentials, Kubernetes tokens and kubeconfig files, Docker configuration and registry credentials, .env files, database credentials, CI/CD platform tokens, and cryptocurrency wallet keys. Harvested data was encrypted using AES-256-CBC symmetric encryption with the symmetric key itself encrypted via RSA-4096 public key cryptography, forming a hybrid encryption scheme. Primary exfiltration occurred to attacker-controlled infrastructure. As a fallback mechanism, the malware created public repositories named tpcp-docs under the victim organization and uploaded encrypted stolen data as release assets.

The exposure windows varied by component: trivy v0.69.4 was exposed for approximately 3 hours (18:22 to 21:42 UTC), trivy-action for approximately 12 hours (17:43 UTC March 19 to 05:40 UTC March 20), and setup-trivy for approximately 4 hours (17:43 to 21:44 UTC). Any CI/CD pipeline that executed during these windows using mutable version tags was potentially compromised.

This attack represents a significant evolution in supply chain threats targeting developer security tooling, specifically exploiting the trust relationship between security scanners and CI/CD pipelines to harvest credentials at scale.

## MITRE ATT&CK

- T1195 Supply Chain Compromise
- T1059 Command and Scripting Interpreter
- T1204 User Execution
- T1036 Masquerading
- T1553 Subvert Trust Controls
- T1003 OS Credential Dumping
- T1552 Unsecured Credentials
- T1005 Data from Local System
- T1119 Automated Collection
- T1567 Exfiltration Over Web Service
- T1041 Exfiltration Over C2 Channel
- T1583 Acquire Infrastructure
- T1586 Compromise Accounts

## Sources

- [GHSA-69fq-xp46-6x23 — Trivy Ecosystem Supply Chain Compromise](https://github.com/aquasecurity/trivy/security/advisories/GHSA-69fq-xp46-6x23)
- [Aqua Security Blog — Trivy Supply Chain Attack: What Happened and What You Need to Know](https://www.aquasec.com/blog/autonomous-runtime-security-turning-runtime-intelligence-into-agentic-response-2/)
- [Malicious Commit 1885610c — trivy repository](https://github.com/aquasecurity/trivy/commit/1885610c)
- [GHSA-9p44-j4g5-cfx5 — Script Injection via Sourced Env File (Preceding Advisory)](https://github.com/aquasecurity/trivy-action/security/advisories/GHSA-9p44-j4g5-cfx5)
- [Trivy v0.69.3 Safe Release (Immutable)](https://github.com/aquasecurity/trivy/releases/tag/v0.69.3)
- [Aqua Security Trivy GitHub Repository](https://github.com/aquasecurity/trivy)
- [Aqua Security trivy-action GitHub Repository](https://github.com/aquasecurity/trivy-action)
- [CWE-506: Embedded Malicious Code](https://cwe.mitre.org/data/definitions/506.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0263