Critical Trivy Vulnerability CVE-2023-45288 Exposes Credentials

Key Takeaways

• A sophisticated supply chain attack compromised the official Trivy GitHub Action (aquasecurity/trivy-action) in late March 2026.
• Threat actors force-pushed malicious infostealer code to 75 out of 76 existing version tags, impacting over 10,000 GitHub workflow files.
• The infostealer, identified as “TeamPCP Cloud stealer,” targets credentials, SSH keys, cloud provider secrets, CI/CD configurations, and cryptocurrency wallet data from both GitHub-hosted and self-hosted runners.
• Only version @0.35.0 and the specific commit SHA 57a97c7e7821a5776cebc9bb87c984fa69cba8f1 remain uncompromised.
• Immediate action is required to update Trivy Action references, rotate exposed secrets, and audit GitHub organizations for malicious repositories.

In a significant supply chain attack disclosed in late March 2026, continuous integration and continuous deployment (CI/CD) pipelines globally have been targeted through a compromise of the official Trivy GitHub Action, identified as aquasecurity/trivy-action. This incident marks the second distinct security breach impacting the Trivy ecosystem within a single month.

Attackers successfully manipulated 75 of the 76 existing version tags, force-pushing them to distribute a malicious infostealer. Given that more than 10,000 GitHub workflow files rely on this action, the potential scope of credential theft is extensive.

Mechanics of the Tag Poisoning Attack

Rather than pushing new code to a branch or creating a new release, the attackers exploited residual write access, likely stemming from an earlier credential breach, to subtly alter existing version tags. This method allowed them to distribute malware without triggering typical security alerts for new code deployments.

The threat actor force-pushed 75 tags, including widely adopted versions such as @0.33.0 and @0.18.0, to point to newly forged commits. This tactic transformed what were considered trusted and immutable version references into a direct conduit for their custom infostealer malware. By circumventing the need for new releases, the attackers significantly reduced the likelihood of activating automated security alerts or notifying project maintainers of unauthorized repository changes.

To further evade detection, the attackers spoofed Git commit metadata, cloning original author names, dates, and commit messages. This made the malicious commits appear legitimate within repository logs.

The modified code maintained the current master file tree but replaced the legitimate entrypoint.sh file with an infected version. While the malicious commit dates conflicted with the March 2026 parent commit, and the commits lacked GitHub’s web-flow GPG signature, a careful inspection was required to reveal the forgery. Notably, version @0.35.0 was the only tag that remained uncompromised and is considered safe, as detailed in a report by Socket.

Infostealer Capabilities and Exfiltration

The injected 204-line entrypoint.sh script executes its malicious functions before the legitimate Trivy scan, allowing it to remain hidden. According to Socket, the infostealer operates in three distinct phases: targeted collection, robust encryption, and stealthy exfiltration.

During the collection phase, the malware targets both GitHub-hosted and self-hosted runners. In GitHub-hosted Linux environments, it leverages passwordless sudo privileges to dump the Runner.Worker process memory, extracting secrets directly from the heap. For self-hosted runners, a comprehensive Python script scrapes the filesystem for sensitive data across multiple directories. This script systematically searches for SSH keys, database credentials, CI/CD configuration files, and even cryptocurrency wallet data, ensuring a thorough collection of valuable information, as noted by Socket.

In the second stage, the stolen data is compressed and encrypted using AES-256-CBC, with the encryption key further protected by an RSA-4096 public key. Finally, the malware attempts to exfiltrate this encrypted bundle via an HTTPS POST request to a typosquatted domain, scan[.]aquasecurtiy[.]org. Should this primary channel fail, the script utilizes the victim’s own GitHub Personal Access Token to create a public repository named tpcp-docs and uploads the stolen data as a release asset, a method also highlighted by Socket.

The malware identifies itself as the “TeamPCP Cloud stealer.” Security researchers attribute TeamPCP to a cloud-native threat actor known for exploiting misconfigured infrastructure for ransomware and cryptomining operations, as further detailed in the Socket report.

What You Should Do

• Immediately cease referencing trivy-action by version tags, with the sole exception of @0.35.0.
• To ensure complete security, pin the action to the specific safe commit SHA: 57a97c7e7821a5776cebc9bb87c984fa69cba8f1.
• Treat any environment that executed a poisoned tag as fully compromised.
• Urgently rotate all exposed secrets, including cloud credentials, API tokens, and any other sensitive data that could have been accessed.
• Audit your GitHub organizations for any unauthorized tpcp-docs repositories, which may indicate data exfiltration.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.