Trivy Supply Chain Attack — Credential Theft Infostealer via Malicious GitHub Actions Tags (GHSA-69fq-xp46-6x23)
Trivy Supply Chain Attack (TL-2026-0270), also tracked as GHSA-69fq-xp46-6x23, is a critical-severity supply-chain compromise scored CVSS 9.8, first published 2026-03-22. It is attributed to TeamPCP with high confidence, affects Aqua Security Trivy, maps to 22 MITRE ATT&CK techniques (T1003, T1005, T1016), and is covered by 9 detection rules and 25 indicators of compromise.
Key facts for TL-2026-0270
- Threat ID
- TL-2026-0270
- Also known as
- GHSA-69fq-xp46-6x23, TeamPCP Cloud Stealer, Trivy Supply Chain Compromise March 2026
- Severity
- CRITICAL
- CVSS
- 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N)
- Status
- PATCHED
- Category
- SUPPLY_CHAIN
- First published
- 2026-03-22
- Last reviewed
- 2026-03-22
- Attribution
- TeamPCP
- Attribution confidence
- HIGH
- Motivation
- FINANCIAL
- Target sectors
- technology, financial, government, healthcare, cloud-infrastructure, devops, software-development
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 25
Malware and tooling in Trivy Supply Chain Attack
Malware and tooling: TeamPCP Cloud Stealer
On March 19, 2026, threat actor TeamPCP leveraged previously compromised credentials to publish a malicious Trivy v0.69.4 release, force-push 76 of 77 version tags in aquasecurity/trivy-action to credential-stealing malware, and replace all 7 tags in aquasecurity/setup-trivy with malicious commits. The infostealer dumped CI runner process memory, scanned 50+ filesystem paths for secrets, encrypted exfiltrated data with AES-256-CBC + RSA-4096 hybrid encryption, and transmitted to attacker-controlled infrastructure with a fallback mechanism creating public repositories containing encrypted credential bundles.
How Trivy Supply Chain Attack works
On March 19, 2026, a sophisticated supply chain attack compromised the Trivy vulnerability scanner ecosystem — one of the most widely-used open source security scanning tools with over 10,000 GitHub workflow integrations. The attack represents the second compromise of the Trivy ecosystem following the February 28 'hackerbot-claw' incident, exploiting credentials that were not fully rotated due to non-atomic credential replacement processes.
The threat actor, self-identifying as TeamPCP (also tracked as DeadCatx3, PCPcat, and ShellForce), used compromised repository write credentials to execute a multi-pronged attack: (1) publishing a trojanized Trivy v0.69.4 binary release, (2) force-pushing 76 of 77 version tags in aquasecurity/trivy-action to malicious commits containing a credential stealer, and (3) replacing all 7 version tags in aquasecurity/setup-trivy with malicious commits. The attacker used imposter commits with spoofed author metadata, cloned commit messages, and manipulated timestamps to evade detection.
The malicious payload in GitHub Actions operated in three stages. First, the modified entrypoint.sh (expanded from 2,855 bytes to 17,592 bytes with 105 lines of attack code prepended) enumerated GitHub Actions runner PIDs (Runner.Worker, Runner.Listener, runsvc, run.sh) and read /proc/<pid>/environ targeting variables containing 'env' or 'ssh'. On GitHub-hosted runners, a base64-encoded Python script read Runner.Worker process memory via /proc/<pid>/maps and /proc/<pid>/mem, extracting JSON structures matching the pattern {"name":{"value":"<secret>","isSecret":true}}. On self-hosted runners, the malware performed comprehensive filesystem credential scraping targeting SSH keys, AWS/GCP/Azure credentials, Kubernetes configs, Docker registries, database credentials, CI/CD configs (GitLab, Travis, Jenkins, Drone), Terraform state, Ansible/Helm configs, TLS/SSL keys, .env files, cryptocurrency wallet keys (Bitcoin, Ethereum, Solana validators, Cardano), GPG keys, and system files including /etc/passwd, /etc/shadow, and shell histories — over 50 distinct filesystem paths.
Collected credentials were encrypted using a hybrid scheme: AES-256-CBC with PBKDF2 key derivation (32-byte session key) wrapped with a hardcoded 4096-bit RSA public key (RSA-OAEP). The encrypted bundle was packaged as tpcp.tar.gz and exfiltrated via HTTPS POST to scan.aquasecurtiy.org (a typosquatted domain resolving to 45.148.10.212, hosted by TECHOFF SRV LIMITED in Amsterdam) with a custom X-Filename header. If the primary C2 was unreachable and INPUT_GITHUB_PAT was available, the malware created a public GitHub repository named tpcp-docs and uploaded the encrypted bundle as a release asset with a timestamped tag, allowing the attacker to retrieve stolen credentials via GitHub repository search.
The trojanized Trivy v0.69.4 binary included additional capabilities: parallel execution alongside the legitimate Trivy service for stealth, environment variable collection, network interface enumeration, and a persistence mechanism that created ~/.config/systemd/user/sysmon.py with a systemd user unit. This dropper polled the ICP-hosted C2 at tdtqy-oyaaa-aaaae-af2dq-cai.raw.icp0.io every 5 minutes via kamikaze.sh, downloading and executing additional payloads to /tmp/pglog (disguised as PostgreSQL logging). A Cloudflare Tunnel (plug-tab-protective-relay.trycloudflare.com) was also used for secret exfiltration.
The attack was detected by multiple security vendors including StepSecurity Harden-Runner (which flagged anomalous outbound connections to the typosquatted domain across 45+ public repositories) and CrowdStrike Falcon (which detected the malicious entrypoint.sh execution pattern). Exposure windows varied: the malicious Trivy binary was available for approximately 3 hours, setup-trivy for 4 hours, and trivy-action for up to 12 hours. The attack subsequently expanded on March 22 with CanisterWorm spreading to 47 npm packages and malicious Docker Hub images (v0.69.5, v0.69.6) being published.
Tag manipulation was achieved by creating commits using the master HEAD file tree, swapping only entrypoint.sh with the malicious payload, cloning original commit metadata, and force-pushing to existing version tags. Detection indicators include missing GPG signatures on commits, impossible parent timestamps, single-file modifications, and the GitHub UI showing '0 commits to master since this release' for older tags.
MITRE ATT&CK techniques used in TL-2026-0270
credential-access
T1003 OS Credential Dumping; T1552 Unsecured Credentials; T1555 Credentials from Password Stores
collection
T1005 Data from Local System; T1560 Archive Collected Data
discovery
T1016 System Network Configuration Discovery; T1057 Process Discovery; T1083 File and Directory Discovery
defense-evasion
T1036 Masquerading; T1070 Indicator Removal
exfiltration
T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service
execution
T1059 Command and Scripting Interpreter
command-and-control
T1071 Application Layer Protocol; T1105 Ingress Tool Transfer; T1573 Encrypted Channel
initial-access
T1195 Supply Chain Compromise; T1199 Trusted Relationship
persistence
T1547 Boot or Logon Autostart Execution
resource-development
T1583 Acquire Infrastructure; T1586 Compromise Accounts
defense-impairment
Affected products and versions in Trivy Supply Chain Attack
- Aqua Security — Trivy
Vulnerable versions: 0.69.4
Fixed in: 0.69.2; 0.69.3 - Aqua Security — aquasecurity/trivy-action
Vulnerable versions: 0.0.1 through 0.34.2
Fixed in: 0.35.0 - Aqua Security — aquasecurity/setup-trivy
Vulnerable versions: 0.2.0 through 0.2.5
Fixed in: 0.2.6 - Aqua Security — aquasec/trivy (Docker Hub)
Vulnerable versions: 0.69.4; 0.69.5; 0.69.6
Fixed in: 0.69.3
Remediation for Trivy Supply Chain Attack
Patches
- Update trivy-action to v0.35.0 (uncompromised version pinned to master HEAD 57a97c7e)
- Update setup-trivy to v0.2.6 (clean version published during incident response)
- Remove or replace Trivy v0.69.4 binary — use v0.69.2 or v0.69.3 as safe alternatives
- Verify trivy-action commit SHA matches 57a97c7e7821a5776cebc9bb87c984fa69cba8f1
Immediate actions
- Pin all GitHub Actions to full immutable commit SHA hashes instead of mutable version tags
- Identify any CI/CD workflows that executed aquasecurity/trivy-action or aquasecurity/setup-trivy between March 19-20, 2026
- Rotate ALL secrets accessible to affected workflow jobs: GitHub tokens, cloud credentials, SSH keys, API tokens, database passwords
- Audit outbound network connections from CI/CD runners for connections to scan.aquasecurtiy.org or 45.148.10.212
- Search GitHub for any tpcp-docs repositories created by organization accounts as exfiltration fallback indicator
- Block IOC domains and IPs at network perimeter: scan.aquasecurtiy.org, 45.148.10.212, tdtqy-oyaaa-aaaae-af2dq-cai.raw.icp0.io
Workarounds
- Pin GitHub Actions to specific commit SHAs rather than version tags
- Use trivy-compromise-scanner open source tool to identify exposed workflow runs
- Audit GitHub Enterprise for public repositories using pull_request_target workflows with elevated permissions
- Monitor for Runner.Worker process memory access patterns on self-hosted runners
Longer-term hardening
- Implement GitHub Actions allowlists restricting which actions can execute in organization workflows
- Deploy network monitoring on CI/CD runners with equivalent rigor applied to production hosts
- Require GPG-signed commits and tags for all GitHub Actions dependencies
- Implement Harden-Runner or equivalent runtime security monitoring for GitHub Actions workflows
- Establish credential rotation runbooks with atomic rotation procedures preventing staggered exposure windows
- Treat pipeline code as production code requiring equivalent security controls and review processes
Weaknesses (CWE) in Trivy Supply Chain Attack
CWE-1357, CWE-494, CWE-506, CWE-829
Timeline of Trivy Supply Chain Attack
- Initial Trivy ecosystem compromise via 'hackerbot-claw' incident — repository takeover, credential theft, and GitHub Releases deletion
- Initial disclosure of first compromise; Aqua Security begins credential rotation but rotation is non-atomic, leaving residual credential access for attacker
- 23:13 UTC — Maintainer deletes malicious trivy v0.69.4 tag from repository
- 21:07-21:43 UTC — Incident response begins; clean setup-trivy@v0.2.6 published (21:43 UTC); setup-trivy exposure window closes (21:44 UTC); malicious trivy binary removed (21:42 UTC)
- ~19:15 UTC — First suspicious activity detected; CrowdStrike Falcon flags script execution spike across Linux runners; StepSecurity Harden-Runner flags anomalous outbound connections to scan.aquasecurtiy.org across 45+ repositories
- 18:22 UTC — Malicious Trivy v0.69.4 binary becomes available for download via GitHub Releases with trojanized binaries for all platforms
- 17:51 UTC — aqua-bot deletes v0.70.0 tag as part of attack manipulation of release infrastructure
- 17:43 UTC — TeamPCP uses residual compromised credentials to publish malicious trivy v0.69.4 tag; aqua-bot pushes to branch. trivy-action and setup-trivy tags begin force-push to malicious commits
- 05:40 UTC — trivy-action exposure window closes after 12 hours; all 76 tags restored to legitimate commits. Public disclosure begins with blog posts from multiple security vendors
- GitHub Security Advisory GHSA-69fq-xp46-6x23 published; Aqua Security publishes official incident blog post detailing full attack chain and remediation guidance
- 21:31 UTC — ICP Canister hosting fallback C2 (tdtqy-oyaaa-aaaae-af2dq-cai.raw.icp0.io) marked 'Unavailable Due to Policy Violation' and taken offline
- 13:15-16:00 UTC — Attack expands: CanisterWorm self-spreads to 47 npm packages; malicious Docker Hub images (v0.69.5, v0.69.6) published
- As of 2026-05-29, the Trivy supply chain compromise (GHSA-69fq-xp46-6x23 / CVE-2026-33634) is contained and patched: malicious tags/binaries/images were removed and fixed versions (Trivy 0.69.2/0.69.3, trivy-action 0.35.0, setup-trivy 0.2.6) published. The CVE was added to CISA KEV (Mar 26, deadline Apr 16) but exposure windows have closed, though actor TeamPCP remains active via CanisterSprawl.
Sources cited for Trivy Supply Chain Attack
- Aqua Security Blog — Trivy Supply Chain Attack: What Happened and What You Need to Know
- GitHub Security Advisory GHSA-69fq-xp46-6x23
- Trivy Security Incident Discussion #10425
- CrowdStrike — From Scanner to Stealer: Inside the trivy-action Supply Chain Compromise
- Wiz — Trivy Compromised by TeamPCP Supply Chain Attack
- StepSecurity — Trivy Compromised a Second Time
- Socket.dev — Trivy Under Attack Again: Widespread GitHub Actions Tag Compromise
- BleepingComputer — Trivy vulnerability scanner breach pushed infostealer via GitHub Actions
- The Hacker News — Trivy Security Scanner GitHub Actions Breached, 75 Tags Hijacked to Steal CI/CD Secrets
- CSO Online — Trivy vulnerability scanner backdoored with credential stealer in supply chain attack
- The Hacker News — Trivy Supply Chain Attack Triggers Self-Spreading CanisterWorm Across 47 npm Packages
- Upwind — Trivy Supply Chain Incident: GitHub Actions Compromise Breakdown
- aquasecurity/trivy-action Issue #541 — Action is Compromised
Threats related to Trivy Supply Chain Attack
- Trivy Supply Chain Compromise by TeamPCP — Credential-Stealing Malware in v0.69.4, trivy-action, and setup-trivy GitHub Actions
- Checkmarx KICS GitHub Action Supply Chain Compromise by TeamPCP (kics-github-action Tag Hijacking)
- Trivy Supply Chain Compromise — TeamPCP Credential-Stealing Malware Injected into CI/CD Pipelines (CVE-2026-33634)
- TeamPCP Supply Chain Campaign: LiteLLM PyPI Compromise, CanisterWorm npm Propagation, and Multi-Ecosystem Attack (CVE-2026-33634)
- TeamPCP LiteLLM Supply Chain Attack — Trojaned PyPI Packages (v1.82.7/1.82.8) with Multi-Stage C2 Payload
- TeamPCP Partners With Vect Ransomware Group to Escalate Cross-Ecosystem Open Source Supply Chain Attacks
Detection coverage for TL-2026-0270
As of 2026-03-22, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0270 across Splunk SPL, Microsoft KQL and Sigma, covering 25 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.