Trivy GitHub Action Compromise Rewrites 75 Tags to Steal CI/CD Secrets
Summary
Socket reports that attackers force-updated 75 of 76 aquasecurity/trivy-action tags, inserting an infostealer targeting CI/CD secrets. Maintainers attribute access to a compromised write credential; TeamPCP attribution is plausible but unconfirmed.
Key points
- The attacker force-updated 75 of 76 version tags; workflows using poisoned tags could run malicious code before the legitimate Trivy scan. The article identifies 0.35.0 as the only unaffected tag.
- The payload targets runner environment variables, SSH keys, cloud credentials, Kubernetes tokens, and other files; on GitHub-hosted Linux runners it also attempts to dump Runner.Worker memory.
- Collected data is encrypted before exfiltration to scan[.]aquasecurtiy[.]org. If that channel fails and a suitable GitHub token is available, the payload can create a public tpcp-docs repository in the victim’s account.
- The attacker spoofed commit metadata to resemble original tag commits. Unsigned commits, dates inconsistent with their parent commits, and changes limited to entrypoint.sh are described as clues.
- Trivy maintainers say the attacker used a compromised credential with repository write access, potentially retaining access after credentials from an earlier incident were rotated.
- The payload’s comment identifies TeamPCP, but the article says attribution could be a false flag; technical overlap makes the attribution plausible, not confirmed.
- The article recommends stopping use of version tags, pinning to the specified full commit SHA or using 0.35.0, rotating secrets accessible to affected workflows, and auditing for tpcp-docs repositories.
Article Details
- Attack Vectors
- A compromised credential with repository write access was used to force-update 75 of 76 version tags in aquasecurity/trivy-action, redirecting workflows that referenced those tags to malicious commits.
- The altered entrypoint.sh ran an infostealer before the legitimate Trivy scan, making the workflow appear to complete normally while collecting runner data.
- The payload searched runner process environments and files for secrets and credentials; on GitHub-hosted Linux runners, it used sudo to dump readable memory from Runner.Worker.
- The payload encrypted collected data with AES-256-CBC and wrapped the session material with an embedded RSA-4096 public key before exfiltration.
- The primary exfiltration channel sent the encrypted bundle over HTTPS to a typosquatted domain. If that failed and INPUT_GITHUB_PAT was available, the payload attempted to create a public tpcp-docs repository in the victim’s GitHub account and upload the bundle as a release asset.
- Defensive Notes
- Stop using trivy-action by version tag. The article identifies commit SHA 57a97c7e7821a5776cebc9bb87c984fa69cba8f1 as a safe pin and reports that tag 0.35.0 appeared to be the only unaffected tag.
- Treat pipelines that ran a poisoned tag as compromised and rotate all secrets accessible to those workflows, including cloud credentials, SSH keys, API tokens, database passwords, and Docker registry tokens.
- Audit GitHub organizations for tpcp-docs repositories and review GitHub Actions logs for trivy-action runs after approximately 19:00 UTC on March 19, 2026.
- Check affected tags and commits for the article’s reported forgery indicators: missing GitHub web-flow signatures, original-looking dates paired with a March 2026 parent, changes limited to entrypoint.sh, and a release-page counter showing “0 commits to master since this release.”
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | scan[.]aquasecurtiy[.]org | Typosquatted attacker-controlled endpoint used to receive the encrypted stolen-data bundle over HTTPS. |
| SHA256 | 18a24f83e807479438dcab7a1804c51a00dafc1d526698a66e0640d1e5dd671a | SHA-256 hash identified in the article for the malicious entrypoint.sh infostealer script. |
MITRE ATT&CK
T1003.007 · Proc FilesystemOn GitHub-hosted Linux runners, the payload read Runner.Worker memory through /proc/<pid>/maps and /proc/<pid>/mem to recover secrets.T1016 · System Network Configuration DiscoveryThe payload ran ip addr and ip route to collect network configuration information.T1057 · Process DiscoveryThe payload searched for GitHub Actions runner processes, including Runner.Worker, Runner.Listener, runsvc, and run.sh.T1059.004 · Unix ShellThe malicious entrypoint is a shell script that runs the collection, encryption, and exfiltration steps.T1059.006 · PythonBase64-encoded Python payloads were decoded and executed to dump runner memory or search files for credentials.T1078.004 · Cloud AccountsA compromised credential with write access to the repository enabled authenticated force-updates of the action’s tags.T1082 · System Information DiscoveryThe self-hosted runner payload ran hostname and uname -a to collect system information.T1083 · File and Directory DiscoveryThe payload recursively searched runner directories and multiple filesystem roots for credential files, environment files, keys, and configuration data.T1119 · Automated CollectionThe payload automated collection across runner environments, credential files, cloud configurations, Kubernetes data, keys, and other sensitive artifacts.T1195.002 · Compromise Software Supply ChainThe attacker altered existing aquasecurity/trivy-action version tags to deliver malicious entrypoint.sh code to workflows consuming the action.T1552.001 · Credentials In FilesThe filesystem harvester searched credential and configuration files, including cloud credentials, Git credentials, tokens, and environment files.T1552.004 · Private KeysThe payload collected SSH keys and other private-key files from runner filesystems.T1552.005 · Cloud Instance Metadata APIThe harvester queried AWS EC2 instance metadata and ECS container credentials for cloud credentials.T1567 · Exfiltration Over Web ServiceThe payload exfiltrated the encrypted bundle over HTTPS to an attacker-controlled web endpoint.T1567.001 · Exfiltration to Code RepositoryAs a fallback, the payload attempted to upload the encrypted bundle as a release asset in a tpcp-docs repository created in the victim’s GitHub account.
People
Threat Actors
Malware
Vendors
Aqua Security[Domain ] exfiltration endpoint (typosquat of Aqua Security) – scan[.]aquasecurtiy[.]orgGitHubA supply chain attack compromised the aquasecurity/trivy-action GitHub Action by force-updating 75 version tags to point to malicious commits that replaced the action entrypoint with an infostealer, putting over 10,000SocketSocket detected the campaign in real time at ~19:15 UTC on March 19, 2026, generating numerous threat feed entries and classifying the activity as Backdoor/Infostealer/Reconnaissance; Trivy maintainers confirmed
Products
aquasecurity/trivy-actionA supply chain attack compromised the aquasecurity/trivy-action GitHub Action by force-updating 75 version tags to point to malicious commits that replaced the action entrypoint with an infostealer, putting over 10,000GitHub Actionsrunner environment variables, SSH keys, cloud credentials, Kubernetes tokens, and optionally dumping GitHub Actions Runner.Worker memory to extract secrets.TrivyA supply chain attack compromised the aquasecurity/trivy-action GitHub Action by force-updating 75 version tags to point to malicious commits that replaced the action entrypoint with an infostealer, putting over 10,000