# Trivy Compromised: Everything You Need to Know about the Latest Supply Chain Attack

TeamPCP compromised Aqua's Trivy repo, actions and binaries, injecting credential-stealing malware that exfiltrated CI/CD secrets from downstream GitHub Actions runners.

- Payout: Real-world hack
- Severity: critical
- Program: Aqua Trivy
- Credited: Wiz Research
- Disclosed: 2026-03-20
- Write-up quality: 8/10
- Original: https://www.wiz.io/blog/trivy-compromised-teampcp-supply-chain-attack
- Library page: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-trivy-compromised-teampcp-supply-chain-attack
- Tags: domain:cloud impact:data-leak impact:mass-exploit kind:incident platform:threat-intel sev:critical tech:github-actions technique:incomplete-fix technique:source-review vuln:misconfiguration vuln:secrets-leak

**Target:** Trivy scanner releases, trivy-action and setup-trivy GitHub Actions, Docker Hub/GHCR/ECR images
**Root cause:** Attacker retained access from an earlier incident, spoofed commits to actions/checkout and aquasecurity/trivy, and compromised the aqua-bot service account to force-push malicious tags and workflows.
**Steps:**
1. Push imposter commit to aquasecurity/trivy spoofing DmitriyLewen; push v0.69.4 tag at 17:43:37 UTC triggering release
2. Malicious checkout fetches stealer from typosquat `scan.aquasecurtiy[.]org` (45.148.10.212); backdoored binaries published to GitHub Releases, Docker Hub, GHCR, ECR
3. Force-push 75/76 trivy-action tags and 7 setup-trivy tags to malicious commits
4. Injected payload in `entrypoint.sh` (trivy-action) and `action.yaml` (setup-trivy) runs on victim runner
5. Scrape `/proc/<pid>/mem` of Runner.Worker for `{"value":"<secret>","isSecret":true}`; sweep 50+ paths for SSH/cloud/K8s keys and wallets
6. Encrypt with AES-256-CBC + RSA-4096 into `tpcp.tar.gz`; POST to `scan.aquasecurtiy[.]org` or Cloudflare Tunnel `plug-tab-protective-relay.trycloudflare.com`
7. Fallback: use stolen GITHUB_TOKEN to create `tpcp-docs` repo and upload bundle as release asset
8. On dev machines (GITHUB_ACTIONS != true): write `~/.config/systemd/user/sysmon.py` + systemd unit; poll `tdtqy-oyaaa-aaaae-af2dq-cai.raw.icp0.io` for next-stage payload to `/tmp/pglog`
**How found:** Wiz Research tracked TeamPCP activity, correlated imposter commits and tag force-pushes, analyzed malicious workflows and binaries to extract C2 infrastructure and stealer behavior.
**Exploitation:** Downstream workflows referencing mutable version tags of trivy-action/setup-trivy executed attacker code on CI runners, harvesting runner memory and filesystem secrets, encrypting and exfiltrating them; malicious Trivy v0.69.4 binary ran legit service alongside stealer and installed systemd persistence on developer machines.
**Escalation:** Pivoted from repo access to aqua-bot service account, then to tfsec, traceeshark, trivy-action; stole GPG keys and Docker Hub/Twitter/Slack credentials; expanded to npm via CanisterWorm using stolen publish tokens; republished malicious Docker Hub images 0.69.5/0.69.6.
**Insight:** Mutable version tags on GitHub Actions are a supply-chain pivot: force-pushing tags silently weaponizes every downstream workflow pinned to a tag, so audit tag-vs-SHA pinning and hunt for stealer artifacts like runner memory scraping of /proc/<pid>/mem and fallback exfil repos.