StepSecurity Details Second Trivy Compromise Affecting Releases and GitHub Actions

Mar 20, 2026 · Original article ↗

Summary

StepSecurity reports that a March 2026 compromise injected credential stealers into Trivy v0.69.4 and two GitHub Actions. Runtime analysis observed Runner.Worker memory access and C2 traffic; 45 of 767 reviewed repositories ran compromised actions.

Key points

The March 19 compromise affected Trivy v0.69.4, aquasecurity/trivy-action tags 0.0.1–0.34.2, and aquasecurity/setup-trivy. The reported exposure windows were about three, 12, and four hours, respectively.
The injected code harvested runner environment variables and read Runner.Worker memory for secrets loaded by workflows. StepSecurity says only secrets actually loaded into that process were accessible through this method.
The credential stealer was configured to encrypt collected data and send it to the typosquatted C2 domain scan[.]aquasecurtiy[.]org, with a GitHub repository upload as a fallback if the C2 was unreachable.
In controlled workflow tests, StepSecurity observed Python reading Runner.Worker memory and anomalous connections to the C2. The company also reported that Docker Hub images Trivy v0.69.5 and v0.69.6 contained the C2 domain and were removed.
StepSecurity reviewed 767 prominent public repositories and found 45 with a workflow run using a compromised action; five had jobs where custom secrets were directly accessible.
Aqua Security disclosed the exposure windows and remediated the affected actions. Homebrew downgraded Trivy to v0.69.3, and setup-trivy's clean v0.2.6 release was published.
StepSecurity recommends identifying affected workflow runs, rotating credentials accessible to those runs, and checking logs for C2 connections; its scanner does not detect workflows that ran the compromised Trivy binary directly.

Article Details

Attack Vectors: Imposter commits redirected tags for aquasecurity/trivy-action and aquasecurity/setup-trivy to code containing credential stealers.
The trivy v0.69.4 release contained malicious code, and Docker Hub images aquasec/trivy:0.69.5 and aquasec/trivy:0.69.6 were also reported to contain the C2 domain.
The injected code harvested runner environment variables and read /proc/<pid>/mem to extract GitHub Actions secrets from Runner.Worker memory.
The credential stealer searched for SSH keys, Git credentials, cloud and Kubernetes credentials, Docker configuration, database credentials, Terraform state, crypto wallets, private keys, and shell histories.
Collected data was encrypted and sent to scan.aquasecurtiy.org; a fallback attempted to create a public tpcp-docs repository on the victim's GitHub account and upload stolen data as a release asset.
Defensive Notes: Review workflow and network logs for connections to scan.aquasecurtiy.org or 45.148.10.212, including pipelines that downloaded and ran the trivy binary directly.
Identify affected workflow runs and rotate credentials accessible to them, including GITHUB_TOKEN and explicitly referenced secrets; the article advises prioritizing secrets actually loaded into Runner.Worker memory.
Monitor for secondary compromises, including newly created workflows that access secrets.
Use the article's reported clean versions: trivy v0.69.3 or earlier, trivy-action v0.35.0, and setup-trivy v0.2.6; verify references before use.
The article describes Harden-Runner outbound block policies and Lockdown Mode as ways to block C2 traffic or stop jobs when suspicious process activity such as Runner.Worker memory reads is detected.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`scan[.]aquasecurtiy[.]org`	Typosquatted C2 domain identified as receiving encrypted stolen data.
IPV4	`45[.]148[.]10[.]212`	IP address reported as resolving from the typosquatted C2 domain.
SHA1	`2b1dac84ff12ba56158b3a97e2941a587cb20da9`	Compromised aquasecurity/trivy-action commit SHA listed for tag 0.15.0.
SHA1	`384add36b52014a0f99c0ab3a3d58bd47e53d00f`	Compromised aquasecurity/setup-trivy commit SHA listed in the article's IOC section.
SHA1	`38623bf26706d51c45647909dcfb669825442804`	Compromised aquasecurity/trivy-action commit SHA listed for tag 0.19.0.
SHA1	`386c0f18ac3d7f2ed33e2d884761119f4024ff8a`	Compromised aquasecurity/setup-trivy commit SHA listed in the article's IOC section.
SHA1	`3c615ac0f29e743eda8863377f9776619fd2db76`	Compromised aquasecurity/trivy-action commit SHA listed for tag 0.0.11.
SHA1	`66c90331c8b991e7895d37796ac712b5895dda3b`	Compromised aquasecurity/trivy-action commit SHA listed for tag 0.27.0.
SHA1	`6d8d730153d6151e03549f276faca0275ed9c7b2`	Compromised aquasecurity/setup-trivy commit SHA listed in the article's IOC section.
SHA1	`7a4b6f31edb8db48cc22a1d41e298b38c4a6417e`	Compromised aquasecurity/setup-trivy commit SHA listed in the article's IOC section.
SHA1	`820428afeb64484d311211658383ce7f79d31a0a`	Compromised aquasecurity/trivy-action commit SHA listed for tag 0.12.0.
SHA1	`8aa8af3ea1de8e968a3e49a40afb063692ab8eae`	Compromised aquasecurity/trivy-action commit SHA listed for tag 0.10.0.
SHA1	`8afa9b9f9183b4e00c46e2b82d34047e3c177bd0`	Compromised aquasecurity/setup-trivy commit SHA containing injected credential-stealing code.
SHA1	`8cfb9c31cc944da57458555aa398bb99336d5a1f`	Compromised aquasecurity/trivy-action commit SHA listed for tag 0.3.0.
SHA1	`9092287c0339a8102f91c5a257a7e27625d9d029`	Compromised aquasecurity/trivy-action commit SHA listed for tag 0.20.0.
SHA1	`99b93c070aac11b52dfc3e41a55cbb24a331ae75`	Compromised aquasecurity/setup-trivy commit SHA listed in the article's IOC section.
SHA1	`9e8968cb83234f0de0217aa8c934a68a317ee518`	Compromised aquasecurity/trivy-action commit SHA listed for tag 0.1.0.
SHA1	`ad623e14ebdfe82b9627811d57b9a39e283d6128`	Compromised aquasecurity/trivy-action commit SHA listed for tag 0.30.0.
SHA1	`b9faa60f85f6f780a34b8d0faaf45b3e3966fdda`	Compromised aquasecurity/trivy-action commit SHA listed for tag 0.0.10.
SHA1	`ddb94181dcbc723d96ffc07fddd14d97e4849016`	Compromised aquasecurity/trivy-action commit SHA listed for tag 0.25.0.
SHA1	`ddb9da4475c1cef7d5389062bdfdfbdbd1394648`	Compromised aquasecurity/trivy-action commit SHA listed for tag 0.34.2.
SHA1	`e53b0483d08da44da9dfe8a84bf2837e5163699b`	Compromised aquasecurity/trivy-action commit SHA listed for tag 0.11.0.
SHA1	`f4436225d8a5fd1715d3c2290d8a50643e726031`	Compromised aquasecurity/setup-trivy commit SHA listed in the article's IOC section.
SHA1	`f5c9fd927027beaa3760d2a84daa8b00e6e5ee21`	Compromised aquasecurity/trivy-action commit SHA listed for tag 0.0.2.
SHA1	`f77738448eec70113cf711656914b61905b3bd47`	Compromised aquasecurity/trivy-action commit SHA listed for tag 0.0.1.
SHA1	`fa4209b6182a4c1609ce34d40b67f5cfd7f00f53`	Compromised aquasecurity/trivy-action commit SHA listed for tag 0.2.5.
SHA1	`fd090040b5f584f4fcbe466878cb204d0735dcf4`	Compromised aquasecurity/trivy-action commit SHA listed for tag 0.23.0.
SHA1	`fd429cf86db999572f3d9ca7c54561fdf7d388a4`	Compromised aquasecurity/trivy-action commit SHA listed for tag 0.32.0.