Trivy Supply-Chain Breach Delivered Credential Stealer Through GitHub Actions
Summary
Aqua Security confirmed attackers used compromised credentials to trojanize Trivy v0.69.4 and trivy-action tags, stealing secrets. Researchers link the activity to TeamPCP and report a follow-up CanisterWorm npm campaign. Users were urged to rotate credentials.
Key points
- Attackers published a trojanized Trivy v0.69.4 release and altered 75 of 76 trivy-action tags; affected workflows could run malicious code before legitimate scans.
- The infostealer collected SSH keys, cloud and CI/CD credentials, environment files, TLS keys, and other secrets, including secrets found in GitHub Actions runner memory.
- Stolen data was sent to a typosquatted server at scan.aquasecurtiy[.]org or, if that failed, uploaded to a public GitHub repository created in the victim's account.
- The malware installed a Python payload as a systemd user service for persistence. Aqua Security said the attackers reused credentials from an earlier incident that had not been fully contained.
- The malicious Trivy release was available for about three hours; compromised GitHub Actions tags remained active for up to 12 hours.
- Researchers linked the follow-up CanisterWorm campaign to TeamPCP. The npm-targeting worm uses stolen tokens to publish malicious package updates and ICP canisters for command and control.
- Organizations that used affected versions were advised to rotate secrets and investigate systems for further compromise.
Article Details
- Victim Organization
- Aqua Security
- Incident Type
- Supply-chain compromise that distributed credential-stealing malware through a trojanized Trivy release and GitHub Actions; a reported follow-up campaign spread a self-propagating npm worm.
- Data Types Exposed
- Credentials and authentication secrets
- SSH keys
- Cloud and infrastructure credentials
- CI/CD credentials and tokens
- Environment variables and .env files
- Database credentials
- TLS private keys
- VPN configurations
- Slack and Discord webhook tokens
- Shell history
- System files and authentication logs
- Cryptocurrency wallet data
- System and network reconnaissance data
- Operational Impact
- The Trivy v0.69.4 release was reportedly available for about three hours, and compromised trivy-action tags remained active for up to 12 hours. Attackers force-pushed 75 of 76 tags, causing workflows using affected tags to run malicious code. The malware collected secrets and attempted exfiltration; it could also establish persistence. Researchers linked a follow-up campaign to a worm that published malicious npm package updates, with Aikido reporting 28 packages published in under 60 seconds.
- Claim Status
- confirmed
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | scan[.]aquasecurtiy[.]org | Typosquatted command-and-control server used by the infostealer to exfiltrate collected data. |
MITRE ATT&CK
T1005 · Data from Local SystemThe infostealer collected credentials and other data from local files, configuration locations, and system information.T1059.006 · PythonA Python payload was used for persistence and to check a remote server for additional payloads.T1195.001 · Compromise Software Dependencies and Development ToolsThe reported CanisterWorm campaign compromised npm packages and published malicious package updates.T1195.002 · Compromise Software Supply ChainAttackers trojanized the Trivy release and GitHub Actions, compromising software distribution.T1543.002 · Systemd ServiceThe malware established persistence by registering a Python payload as a systemd service.T1552 · Unsecured CredentialsThe malware searched for unsecured credentials, including keys, tokens, environment files, and configuration secrets.T1567.001 · Exfiltration to Code RepositoryIf direct exfiltration failed, the malware uploaded stolen data to a public GitHub repository in the victim's account.
People
Threat Actors
Malware
CanisterWormResearchers link the campaign to TeamPCP, which exfiltrated harvested secrets to a typosquatted C2 or public GitHub repos, established persistence, and later spread a self-propagating npm worm named CanisterWorm.TeamPCP Cloud stealerThe attack is believed to be linked to a threat actor known as TeamPCP, as one of the infostealer payloads used in the attack has a “TeamPCP Cloud stealer” comment as the last line of the Python script.
Vendors
Products
GitHub ActionsThe Trivy vulnerability scanner was compromised in a supply-chain attack that trojanized the v0.69.4 release and multiple trivy-action GitHub Actions to distribute credential-stealing malware.npmResearchers link the campaign to TeamPCP, which exfiltrated harvested secrets to a typosquatted C2 or public GitHub repos, established persistence, and later spread a self-propagating npm worm named CanisterWorm.setup-trivyacted as infostealers across the main scanner and related GitHub Actions, including trivy-action and setup-trivy.TrivyThe Trivy vulnerability scanner was compromised in a supply-chain attack that trojanized the v0.69.4 release and multiple trivy-action GitHub Actions to distribute credential-stealing malware.trivy-actionThe Trivy vulnerability scanner was compromised in a supply-chain attack that trojanized the v0.69.4 release and multiple trivy-action GitHub Actions to distribute credential-stealing malware.