Trivy release actions shipped malware

On March 19, 2026, attackers who still held credentials from the February takeover of Aqua Security's Trivy repository used them to publish a malicious Trivy v0.69.4 release and to rewrite the tags of two companion GitHub Actions, trivy-action and setup-trivy, that thousands of CI/CD pipelines already trusted by name. Docker Hub images for 0.69.4, 0.69.5, and 0.69.6 followed days later.

The delivery worked because most consumers pinned by mutable tag rather than full commit SHA. Force-pushed tags swapped the underlying code without changing the workflow files that referenced them. StepSecurity, which documented the second wave, said the compromised setup-trivy commit 8afa9b9 was itself benign but pointed workflows at the poisoned v0.69.4 binary.

The payload read GitHub Actions runner memory and per-process environments, collected developer and cloud secrets, encrypted the archive, and tried to exfiltrate it to scan.aquasecurtiy.org, a typosquat of Aqua's own domain, with public GitHub repositories as a fallback drop. Trivy was an unusually rich target because it already ran inside build and deployment pipelines, where secrets live in plaintext.

The Register, citing Mandiant, reported that more than 1,000 SaaS environments were affected, with researchers warning the number was likely to grow. Aqua removed the malicious tags, published clean releases, and issued advisory GHSA-69fq-xp46-6x23. Stolen CI/CD secrets later bled into adjacent projects, including LiteLLM, extending the blast radius beyond Trivy itself.