Trivy Open-Source Scanner Compromised Again in Supply Chain Attack Aqua Security’s popular open-source vulnerability scanner, Trivy, was compromised for the second time in a month, leading to the distribution of malware designed to steal sensitive CI/CD secrets from GitHub Actions environments. The attack targeted two official GitHub Actions repositories `aquasecurity/trivy-action` and `aquasecurity/setup-trivy` which are widely used to scan Docker images and configure Trivy in workflows. Security researcher Philipp Burckhardt of Socket revealed that attackers force-pushed 75 out of 76 version tags in the `trivy-action` repository, replacing legitimate code with a Python-based infostealer. The malware executes in GitHub Actions runners, harvesting credentials such as SSH keys, cloud provider tokens, database passwords, Kubernetes tokens, and cryptocurrency wallet details. A similar attack affected seven tags in the `setup-trivy` repository. This marks the second supply chain breach involving Trivy in recent weeks. In late February and early March 2026, an autonomous bot (hackerbot-claw) exploited a `pull_request_target` workflow to steal a Personal Access Token (PAT), gaining control of the repository. The attackers then deleted release versions and pushed malicious updates to Trivy’s VS Code extension on Open VSX. The compromised version (0.69.4) executed both legitimate Trivy scans and a data-stealing payload, which: - Scanned systems for environment variables and credentials. - Exfiltrated data via HTTP POST requests to `scan.aquasecurtiy[.]org`. - Established persistence via a systemd service (`sysmon.py`) that fetched and executed additional payloads. Aqua Security confirmed that the attackers abused compromised credentials to publish malicious releases. Unlike typical supply chain attacks, the adversaries rewrote existing tags rather than creating new releases, making detection harder. The exact credential used remains unclear, but the breach stemmed from incomplete containment of the earlier hackerbot-claw incident. Aqua Security acknowledged that token rotation was not atomic, allowing attackers to retain access. The malware operates in three stages: 1. Harvesting environment variables from memory and the filesystem. 2. Encrypting the stolen data. 3. Exfiltrating it to the attacker-controlled server or, if blocked, abusing the victim’s GitHub account to store data in a public repository named `tpcp-docs`. While attribution is unconfirmed, TeamPCP (also known as DeadCatx3, PCPcat, or ShellForce) is suspected due to code self-identification as the "TeamPCP Cloud stealer" and technical overlaps with the group’s known cloud-native theft operations. The focus on Solana validator keys and cryptocurrency wallets aligns with TeamPCP’s financial motivations, though the self-labeling could be a false flag. Aqua Security has since locked down automated actions and tokens to prevent further abuse. The incident underscores risks in tag-based dependency management, as attackers exploited mutable version tags to distribute malware. Security researchers recommend pinning GitHub Actions to full SHA hashes to mitigate similar attacks.