Trivy Supply Chain Compromise
A coordinated attack targeting Aqua Security's Trivy ecosystem, building on the incident from early March.
Initial Compromise
Imposter Commit to actions/checkout
Attacker creates a malicious commit impersonating rauchg (Guillermo Rauch) in the actions/checkout repository. Payload fetches malicious Go files from typosquatted C2 and injects them into the build.
Imposter Commit to aquasecurity/trivy
Attacker duplicates a prior legitimate contribution and impersonates DmitriyLewen. This malicious commit references the imposter checkout action, establishing the attack chain.
Malicious v0.69.4 Tag Pushed
Tag v0.69.4 pushed to trivy repository, pointing to the malicious commit. This triggers automated release workflows.
Malicious Releases Distributed
Automated workflows publish the malicious v0.69.4 release to multiple distribution channels, maximizing supply chain impact.
Lateral Movement via compromised aqua-bot identity
tfsec Workflow Compromised
Malicious workflow added to aquasecurity/tfsec using compromised aqua-bot identity. Workflow dumps secrets, then is reverted.
traceeshark Workflow Compromised
Same attack pattern applied to aquasecurity/traceeshark. Malicious workflow injected via compromised bot account.
trivy-action Workflow Compromised
Attack continues to aquasecurity/trivy-action. This repository is particularly critical as it's used by thousands of downstream projects.
Malicious Distribution
Malicious Action Tags Published
Using compromised aqua-bot credentials, attacker publishes malicious tags for trivy-action and setup-trivy, potentially affecting all downstream users.
Obfuscation coordinated spam flood
Discussion #10420 Flooded
96 spam accounts posted generic praise comments within ~30 seconds, drowning technical discussion and incident coordination. Includes troll comments referencing "sugma" and "ligma".
How did they gain access to push the malicious v0.69.4 tag?
The attacker was able to push a tag to aquasecurity/trivy pointing to a malicious commit. This requires write access to the repository. Was this via a compromised PAT, GitHub App, or deploy key? The initial access vector remains unclear.
Was aqua-bot the initial access vector, or only compromised via /trivy?
The aqua-bot service account was used for lateral movement to tfsec, traceeshark, and trivy-action. However, it's unclear whether aqua-bot credentials were the initial compromise, or if they were harvested from the trivy repository's secrets after the v0.69.4 tag push triggered workflows.
What was the v0.70.0 trivy attacker tag?
At 17:51:17 UTC on March 19, a v0.70.0 tag was deleted. The commit (9dbb34d3ec0f) was authored by aqua-bot on March 16 — 3 days earlier — with message "Updates", modifying cmd/trivy/main.go, pkg/github/auth.go, pkg/github/repowrite.go, pkg/github/runner.go. This suggests aqua-bot compromise may predate March 19.
What was the setup-trivy@v0.2.5 poisoning?
Commit 8afa9b9f was pushed to aquasecurity/setup-trivy, spoofing contributor "thara" (Tomochika Hara). Message: "Pin Trivy install script checkout to a specific commit (#28)". Spoofed date: 2026-01-15 (actual push time unknown).
Is DarkSeek3r related?
A GitHub user "DarkSeek3r" (now deleted, user ID 266895321) was created at 2026-03-10T01:44:23. Their only public activity before account deletion was forking aquasecurity/trivy and actions/checkout — the exact repositories used in this attack.
C2 Domains & IPs
Imposter & Injected Commits
GitHub Accounts
Poisoned Releases & Images
Strings & Filenames
TeamPCP
Also known as PCPcat, ShellForce, and DeadCatx3. Emerged as a significant threat to cloud-native infrastructure in late 2025.
Self-attribution string "TeamPCP Cloud stealer" found in the trivy-action payload links this incident to the group.
Cloud-Native Infrastructure
Common Techniques
Flare.io Analysis
"TeamPCP Cloud-Native Ransomware" — detailed analysis of the December 2025 worm-driven campaign targeting cloud infrastructure.
20 Days Later: Trivy Compromise Act II
Detailed technical analysis of the second Trivy compromise.
Trivy Under Attack Again: GitHub Actions Compromise
Payload analysis including three-stage exfiltration mechanism and TeamPCP Cloud stealer.
Trivy Compromised a Second Time - Malicious v0.69.4 Release
Timeline and detection guidance for the v0.69.4 supply chain attack.
aquasecurity/trivy
Malware catalog entry with IOCs and package metadata.
Trivy GitHub Actions Compromise
Supply chain attack database entry with affected versions and remediation.
TeamPCP Cloud-Native Ransomware
Analysis of TeamPCP stealer targeting cloud credentials and CI/CD pipelines.