# Trivy Supply Chain Attack — Credential Theft Infostealer via Malicious GitHub Actions Tags (GHSA-69fq-xp46-6x23)

> On March 19, 2026, threat actor TeamPCP leveraged previously compromised credentials to publish a malicious Trivy v0.69.4 release, force-push 76 of 77 version tags in aquasecurity/trivy-action to credential-stealing malware, and replace all 7 tags in aquasecurity/setup-trivy with malicious commits. The infostealer dumped CI runner process memory, scanned 50+ filesystem paths for secrets, encrypted exfiltrated data with AES-256-CBC + RSA-4096 hybrid encryption, and transmitted to attacker-controlled infrastructure with a fallback mechanism creating public repositories containing encrypted credential bundles.

- **Published:** 2026-03-22T12:00:00Z
- **Last reviewed:** 2026-03-22T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0270
- **ID:** TL-2026-0270
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** SUPPLY_CHAIN
- **Status:** PATCHED
- **Actor:** TeamPCP
- **Detections:** 9 · **IOCs:** 25 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On March 19, 2026, a sophisticated supply chain attack compromised the Trivy vulnerability scanner ecosystem — one of the most widely-used open source security scanning tools with over 10,000 GitHub workflow integrations. The attack represents the second compromise of the Trivy ecosystem following the February 28 'hackerbot-claw' incident, exploiting credentials that were not fully rotated due to non-atomic credential replacement processes.

The threat actor, self-identifying as TeamPCP (also tracked as DeadCatx3, PCPcat, and ShellForce), used compromised repository write credentials to execute a multi-pronged attack: (1) publishing a trojanized Trivy v0.69.4 binary release, (2) force-pushing 76 of 77 version tags in aquasecurity/trivy-action to malicious commits containing a credential stealer, and (3) replacing all 7 version tags in aquasecurity/setup-trivy with malicious commits. The attacker used imposter commits with spoofed author metadata, cloned commit messages, and manipulated timestamps to evade detection.

The malicious payload in GitHub Actions operated in three stages. First, the modified entrypoint.sh (expanded from 2,855 bytes to 17,592 bytes with 105 lines of attack code prepended) enumerated GitHub Actions runner PIDs (Runner.Worker, Runner.Listener, runsvc, run.sh) and read /proc/<pid>/environ targeting variables containing 'env' or 'ssh'. On GitHub-hosted runners, a base64-encoded Python script read Runner.Worker process memory via /proc/<pid>/maps and /proc/<pid>/mem, extracting JSON structures matching the pattern {"name":{"value":"<secret>","isSecret":true}}. On self-hosted runners, the malware performed comprehensive filesystem credential scraping targeting SSH keys, AWS/GCP/Azure credentials, Kubernetes configs, Docker registries, database credentials, CI/CD configs (GitLab, Travis, Jenkins, Drone), Terraform state, Ansible/Helm configs, TLS/SSL keys, .env files, cryptocurrency wallet keys (Bitcoin, Ethereum, Solana validators, Cardano), GPG keys, and system files including /etc/passwd, /etc/shadow, and shell histories — over 50 distinct filesystem paths.

Collected credentials were encrypted using a hybrid scheme: AES-256-CBC with PBKDF2 key derivation (32-byte session key) wrapped with a hardcoded 4096-bit RSA public key (RSA-OAEP). The encrypted bundle was packaged as tpcp.tar.gz and exfiltrated via HTTPS POST to scan.aquasecurtiy.org (a typosquatted domain resolving to 45.148.10.212, hosted by TECHOFF SRV LIMITED in Amsterdam) with a custom X-Filename header. If the primary C2 was unreachable and INPUT_GITHUB_PAT was available, the malware created a public GitHub repository named tpcp-docs and uploaded the encrypted bundle as a release asset with a timestamped tag, allowing the attacker to retrieve stolen credentials via GitHub repository search.

The trojanized Trivy v0.69.4 binary included additional capabilities: parallel execution alongside the legitimate Trivy service for stealth, environment variable collection, network interface enumeration, and a persistence mechanism that created ~/.config/systemd/user/sysmon.py with a systemd user unit. This dropper polled the ICP-hosted C2 at tdtqy-oyaaa-aaaae-af2dq-cai.raw.icp0.io every 5 minutes via kamikaze.sh, downloading and executing additional payloads to /tmp/pglog (disguised as PostgreSQL logging). A Cloudflare Tunnel (plug-tab-protective-relay.trycloudflare.com) was also used for secret exfiltration.

The attack was detected by multiple security vendors including StepSecurity Harden-Runner (which flagged anomalous outbound connections to the typosquatted domain across 45+ public repositories) and CrowdStrike Falcon (which detected the malicious entrypoint.sh execution pattern). Exposure windows varied: the malicious Trivy binary was available for approximately 3 hours, setup-trivy for 4 hours, and trivy-action for up to 12 hours. The attack subsequently expanded on March 22 with CanisterWorm spreading to 47 npm packages and malicious Docker Hub images (v0.69.5, v0.69.6) being published.

Tag manipulation was achieved by creating commits using the master HEAD file tree, swapping only entrypoint.sh with the malicious payload, cloning original commit metadata, and force-pushing to existing version tags. Detection indicators include missing GPG signatures on commits, impossible parent timestamps, single-file modifications, and the GitHub UI showing '0 commits to master since this release' for older tags.

## MITRE ATT&CK

- T1195 Supply Chain Compromise
- T1199 Trusted Relationship
- T1059 Command and Scripting Interpreter
- T1547 Boot or Logon Autostart Execution
- T1036 Masquerading
- T1070 Indicator Removal
- T1685 Disable or Modify Tools
- T1003 OS Credential Dumping
- T1555 Credentials from Password Stores
- T1552 Unsecured Credentials
- T1057 Process Discovery
- T1016 System Network Configuration Discovery
- T1083 File and Directory Discovery
- T1005 Data from Local System
- T1560 Archive Collected Data
- T1071 Application Layer Protocol
- T1573 Encrypted Channel
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel
- T1567 Exfiltration Over Web Service
- T1586 Compromise Accounts
- T1583 Acquire Infrastructure

## Sources

- [Aqua Security Blog — Trivy Supply Chain Attack: What Happened and What You Need to Know](https://www.aquasec.com/blog/trivy-supply-chain-attack-what-you-need-to-know/)
- [GitHub Security Advisory GHSA-69fq-xp46-6x23](https://github.com/aquasecurity/trivy/security/advisories/GHSA-69fq-xp46-6x23)
- [Trivy Security Incident Discussion #10425](https://github.com/aquasecurity/trivy/discussions/10425)
- [CrowdStrike — From Scanner to Stealer: Inside the trivy-action Supply Chain Compromise](https://www.crowdstrike.com/en-us/blog/from-scanner-to-stealer-inside-the-trivy-action-supply-chain-compromise/)
- [Wiz — Trivy Compromised by TeamPCP Supply Chain Attack](https://www.wiz.io/blog/trivy-compromised-teampcp-supply-chain-attack)
- [StepSecurity — Trivy Compromised a Second Time](https://www.stepsecurity.io/blog/trivy-compromised-a-second-time---malicious-v0-69-4-release)
- [Socket.dev — Trivy Under Attack Again: Widespread GitHub Actions Tag Compromise](https://socket.dev/blog/trivy-under-attack-again-github-actions-compromise)
- [BleepingComputer — Trivy vulnerability scanner breach pushed infostealer via GitHub Actions](https://www.bleepingcomputer.com/news/security/trivy-vulnerability-scanner-breach-pushed-infostealer-via-github-actions/)
- [The Hacker News — Trivy Security Scanner GitHub Actions Breached, 75 Tags Hijacked to Steal CI/CD Secrets](https://thehackernews.com/2026/03/trivy-security-scanner-github-actions.html)
- [CSO Online — Trivy vulnerability scanner backdoored with credential stealer in supply chain attack](https://www.csoonline.com/article/4148317/trivy-vulnerability-scanner-backdoored-with-credential-stealer-in-supply-chain-attack.html)
- [The Hacker News — Trivy Supply Chain Attack Triggers Self-Spreading CanisterWorm Across 47 npm Packages](https://thehackernews.com/2026/03/trivy-supply-chain-attack-triggers-self.html)
- [Upwind — Trivy Supply Chain Incident: GitHub Actions Compromise Breakdown](https://www.upwind.io/feed/trivy-supply-chain-incident-github-actions-compromise-breakdown)
- [aquasecurity/trivy-action Issue #541 — Action is Compromised](https://github.com/aquasecurity/trivy-action/issues/541)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0270