Trivy Supply Chain Attack — Credential Theft Infostealer via Malicious GitHub Actions Tags (GHSA-69fq-xp46-6x23) — Threadlinqs Intelligence
As of 2026-05-30, Trivy Supply Chain Attack — Credential Theft Infostealer via Malicious GitHub Actions Tags (GHSA-69fq-xp46-6x23) is a critical-severity supply chain threat attributed to TeamPCP (N/A), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 25 indicators of compromise.
Threat ID: TL-2026-0270 · Severity: CRITICAL · CVSS: 9.8 · Status: PATCHED · Category: SUPPLY_CHAIN
Attribution: TeamPCP · N/A · FINANCIAL
On March 19, 2026, threat actor TeamPCP leveraged previously compromised credentials to publish a malicious Trivy v0.69.4 release, force-push 76 of 77 version tags in aquasecurity/trivy-action to
On March 19, 2026, a sophisticated supply chain attack compromised the Trivy vulnerability scanner ecosystem — one of the most widely-used open source security scanning tools with over 10,000 GitHub workflow integrations. The attack represents the second compromise of the Trivy ecosystem following the February 28 'hackerbot-claw' incident, exploiting credentials that were not fully rotated due to non-atomic credential replacement processes.
The threat actor, self-identifying as TeamPCP (also tracked as DeadCatx3, PCPcat, and ShellForce), used compromised repository write credentials to execute a multi-pronged attack: (1) publishing a trojanized Trivy v0.69.4 binary release, (2) force-pushing 76 of 77 version tags in aquasecurity/trivy-action to malicious commits containing a credential stealer, and (3) replacing all 7 version tags in aquasecurity/setup-trivy with malicious commits. The attacker used imposter commits with spoofed author metadata, cloned commit messages, and manipulated timestamps to evade detection.
The malicious payload in GitHub Actions operated in three stages. First, the modified entrypoint.sh (expanded from 2,855 bytes to 17,592 bytes with 105 lines of attack code prepended) enumerated GitHub Actions runner PIDs (Runner.Worker, Runner.Listener, runsvc, run.sh) and read /proc/<pid>/environ targeting variables containing 'env' or 'ssh'. On GitHub-hosted runners, a base64-encoded Python script read Runner.Worker process memory via /proc/<pid>/maps and /proc/<pid>/mem, extracting JSON structures matching the pattern {"name":{"value":"<secret>","isSecret":true}}. On self-hosted runners, the malware performed comprehensive filesystem credential scraping targeting SSH keys, AWS/GCP/Azure credentials, Kubernetes configs, Docker registries, database credentials, CI/CD configs (GitLab, Travis, Jenkins, Drone), Terraform state, Ansible/Helm configs, TLS/SSL keys, .env files, cryptocurrency wallet keys (Bitcoin, Ethereum, Solana validators, Cardano), GPG keys, and system files including /etc/passwd, /etc/shadow, and shell histories — over 50 distinct filesystem paths.
Collected credentials were encrypted using a hybrid scheme: AES-256-CBC with PBKDF2 key derivation (32-byte session key) wrapped with a hardcoded 4096-bit RSA public key (RSA-OAEP). The encrypted bundle was packaged as tpcp.tar.gz and exfiltrated via HTTPS POST to scan.aquasecurtiy.org (a typosquatted domain resolving to 45.148.10.212, hosted by TECHOFF SRV LIMITED in Amsterdam) with a custom X-Filename header. If the primary C2 was unreachable and INPUT_GITHUB_PAT was available, the malware created a public GitHub repository named tpcp-docs and uploaded the encrypted bundle as a release asset with a timestamped tag, allowing the attacker to retrieve stolen credentials via GitHub repository search.
The trojanized Trivy v0.69.4 binary included additional capabilities: parallel execution alongside the legitimate Trivy service for stealth, environment variable collection, network interface enumeration, and a persistence mechanism that created ~/.config/systemd/user/sysmon.py with a systemd user unit. This dropper polled the ICP-hosted C2 at tdtqy-oyaaa-aaaae-af2dq-cai.raw.icp0.io every 5 minutes via kamikaze.sh, downloading and executing additional payloads to /tmp/pglog (disguised as PostgreSQL logging). A Cloudflare Tunnel (plug-tab-protective-relay.trycloudflare.com) was also used for secret exfiltration.
The attack was detected by multiple security vendors including StepSecurity Harden-Runner (which flagged anomalous outbound connections to the typosquatted domain across 45+ public repositories) and CrowdStrike Falcon (which detected the malicious entrypoint.sh execution pattern). Exposure windows varied: the malicious Trivy binary was available for approximately 3 hours, setup-trivy for 4 hours, and trivy-action for up to 12 hours. The attack subsequently expanded on March 22 with CanisterWorm spreading to 47 npm packages and malicious Docker Hub
Weaknesses (CWE)
CWE-1357, CWE-494, CWE-506, CWE-829
Target sectors: technology, financial, government, healthcare, cloud-infrastructure, devops, software-development
Target regions: Global
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 25 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
SUPPLY_CHAIN, CRITICAL, threat intelligence, cybersecurity, T1195, T1199, T1059, T1059, T1547, T1036, T1070, T1562, T1003, T1555