<h2>What happened</h2>
<p>Sometime around March 19-22, 2025, attackers compromised three components of Aqua Security’s open-source Trivy vulnerability scanner: the <code>trivy-action</code> GitHub Action, the <code>setup-trivy</code> GitHub Action, and the Trivy binary itself on Docker Hub.</p>
<p>The attack vector was a misconfigured GitHub Actions workflow. Using stolen credentials, attackers force-pushed malicious code to 75 of 76 version tags in the <code>aquasecurity/trivy-action</code> repository and 7 tags in <code>setup-trivy</code>. They cloned original commit metadata to make the malicious commits look legitimate. On Docker Hub, images tagged <code>0.69.5</code> and <code>0.69.6</code> were pushed on March 22 with no corresponding GitHub releases — both contain indicators of compromise linked to the TeamPCP infostealer, including a typosquatted C2 domain (<code>scan.aquasecurtiy.org</code>) and references to a fallback GitHub repository. The <code>latest</code> tag currently points to the compromised <code>0.69.6</code> image.</p>
<p>Socket threat researchers detected 182 threat feed entries tied to this campaign, classified as backdoor, infostealer, and reconnaissance malware.</p>
<h2>What the malware does</h2>
<p>Once running inside a CI/CD pipeline, the malicious code:</p>
<ul>
<li>Dumps runner process memory</li>
<li>Harvests SSH keys, GitHub tokens, cloud credentials (AWS, GCP, Azure), and Kubernetes tokens</li>
<li>Encrypts and exfiltrates everything to attacker-controlled infrastructure</li>
</ul>
<p>Over 10,000 GitHub workflow files reference <code>trivy-action</code> by version tag, so the potential blast radius is significant.</p>
<h2>Who is affected</h2>
<p>Any pipeline that ran a compromised version should be treated as potentially breached. The Apache Software Foundation confirmed that a small number of ASF projects use the Trivy GitHub Action in their build workflows. In response, ASF Infrastructure and Security disabled all previously allowed “verified creator” actions pending investigation, which may cause build failures for affected projects.</p>
<h2>Safe versions</h2>
<table>
<thead>
<tr>
<th>Component</th>
<th>Last known clean version</th>
</tr>
</thead>
<tbody>
<tr>
<td>Trivy binary / Docker image</td>
<td>v0.69.3</td>
</tr>
<tr>
<td>trivy-action</td>
<td>@0.35.0</td>
</tr>
<tr>
<td>setup-trivy</td>
<td>0.2.6</td>
</tr>
</tbody>
</table>
<h2>What to do now</h2>
<ol>
<li><strong>Stop using Trivy in CI/CD pipelines</strong> until you’ve confirmed you’re on a clean version.</li>
<li><strong>Rotate all pipeline secrets immediately</strong> — GitHub tokens, SSH keys, cloud credentials, Kubernetes tokens. Assume anything that passed through an affected runner is compromised.</li>
<li><strong>Pin actions to full commit SHA hashes</strong> rather than version tags, which can be silently overwritten.</li>
<li><strong>Upgrade to safe versions</strong> listed above.</li>
<li>If you’re an ASF project needing to re-enable actions, go through the Infra GHA approval process.</li>
</ol>
<p>An investigation into whether any ASF project secrets or Git repositories were actually exfiltrated is ongoing. Trivy maintainer Itay Shakury has advised immediate secret rotation for anyone who ran a compromised version.</p>


Collections

Attackers compromised Aqua Security's Trivy vulnerability scanner between March 19-22, 2025, backdooring the trivy-action and setup-trivy GitHub Actions and Docker Hub images (tags 0.69.5 and 0.69.6). The malware, linked to the TeamPCP infostealer, dumps runner memory and exfiltrates SSH keys, GitHub tokens, and cloud credentials (AWS, GCP, Azure, Kubernetes) to attacker-controlled infrastructure. Over 10,000 GitHub workflow files reference trivy-action by version tag, making the blast radius significant. The Apache Software Foundation confirmed some ASF projects were affected and disabled all verified creator actions pending investigation. Immediate actions: stop using Trivy in CI/CD, rotate all pipeline secrets, pin actions to full commit SHA hashes, and upgrade to clean versions (Trivy binary v0.69.3, trivy-action @0.35.0, setup-trivy 0.2.6).

Trivy GitHub Action supply chain attack: what happened and what to do