The Trivy Cascade: 75 Poisoned Tags, a Blockchain Worm, 5 Days of Chaos

The Trivy Cascade: An Investigation into 75 Poisoned Tags, a Blockchain Worm, and Five Days of DevOps Disarray

In a striking example of modern software supply chain vulnerabilities, the events of late February to March 2026 revealed how a single security misconfiguration can escalate into widespread chaos across the open-source community and enterprise environments.

The Initial Breach: An Exploitation of Trivy’s Workflow

On February 28, 2026, an AI-driven cyber threat actor known as hackerbot-claw—purportedly powered by a language model framework called “claude-opus-4-5″—exploited a misconfigured GitHub workflow within the Aqua Security repository for Trivy, a popular vulnerability scanner used extensively in CI/CD pipelines. Specifically, the attacker targeted the pull_request_target workflow, which inadvertently allowed unauthorized access to sensitive credentials—specifically, a Personal Access Token (PAT) with write permissions.

Although Aqua Security responded swiftly by rotating credentials on March 1, the credential reset was incomplete, leaving residual access for malicious actors.

The Subversion: Poisoned Tags and Silent Infection

By March 19, a group identified as TeamPCP leveraged this residual access to push malicious code into the project’s repository. They force-updated 75 of the 76 version tags of the aquasecurity/trivy-action to contain a malicious payload designed to steal credentials and sensitive data during CI/CD runs.

Crucially, over 10,000 workflows on GitHub referenced Trivy using specific version tags, meaning that a vast number of pipelines—often running in enterprise settings—executed these compromised versions. These stealthy injections operated beneath the radar, allowing the attackers to stealthily infect the environment unnoticed.

The Payload: Exfiltration and Data Harvesting

Once executed, the malware employed advanced techniques to extract sensitive information. It accessed the GitHub Actions Runner process memory via /proc/<pid>/mem, harvesting secrets such as SSH keys, cloud provider credentials (AWS, GCP, Azure), Kubernetes tokens, Docker configurations, and npm publish tokens.

Encryption was performed using AES-256-CBC paired with RSA-4096, and data exfiltration was orchestrated through attacker-controlled infrastructure. This method ensured that stolen critical secrets, once exfiltrated, remained concealed and resilient against interception.

Chain Reaction: The Blockchain Worm and Further Compromise

By March 20, the attackers exfiltrated npm tokens associated with compromised artifacts, which served as the entry point for CanisterWorm—a novel and alarming blockchain-based self-propagating npm worm. Leveraging the Internet Computer Protocol (ICP) canisters, the worm autonomously replicated across the npm ecosystem, with the unique capability of resisting takedown through conventional abuse reports.

This resulted in the infection of 66-plus npm packages and 141 malicious artifacts, spreading malicious code and exfiltrating data in a self-sustaining manner.

The Outbreak: Internal Breaches and External Attacks

On March 22, within a matter of minutes, TeamPCP launched a coordinated attack on Aqua Security’s internal GitHub organization, defacing 44 repositories—including proprietary source code for Tracie, internal forks, and CI/CD pipelines. This destructive act exposed sensitive assets and internal operational details.

The following day, the attack expanded further, compromising credentials used by other security firms such as Checkmarx. Notably, on March 24, malicious packages appeared on PyPI, the Python Package Index, including tainted versions of LiteLLM (1.82.7/1.82.8), and a separate deployment targeted Iranian infrastructure using a Kubernetes wiper.

The Irony of a Security Tool Turning Against Itself

Perhaps most ironically, the very tool designed to identify and mitigate vulnerabilities—Trivy—became the vector for infection. What was trusted to secure the supply chain instead facilitated its compromise, exposing a critical flaw in dependency management and security beyond the traditional threat model.

Technical Details and Urgent Recommendations

The vulnerability has been designated CVE-2026-33634, with a severity score of 9.4 (CVSS)—a Priority 0 (P0) incident. Organizations that ran Trivy during March 19–20 are urged to assume that all secrets and credentials exposed during that period are compromised.

Immediate actions include:
– Rotating all cloud provider, SSH, and CI/CD credentials.
– Auditing internal repositories and dependencies for malicious modifications.
– Reviewing and invalidating any potentially compromised tokens.
– Monitoring npm and PyPI packages for unauthorized updates or artifacts.
– Implementing stricter access controls on GitHub workflows and secrets management.

Final Thoughts

This incident underscores the vital importance of supply chain security in modern DevOps environments. Even trusted security tools can become vectors of attack if misconfigurations exist and adequate safeguards are absent. As the industry learns from these events, strengthening the integrity of our CI/CD pipelines and dependency ecosystems becomes paramount.

In the face of persistent threats, vigilance, rapid response, and a comprehensive security posture are essential to safeguarding the digital supply chain.