Trivy ecosystem supply chain compromised via credentials
Threat actors compromised credentials to publish malicious versions of the Trivy security tool and related GitHub Actions and Docker images in March 2026, exposing users to credential-stealing malware for several hours. The compromise cascaded to affect the litellm PyPI package, with malicious versions stealing environment variables and deployment credentials before being removed.
What happened
On March 19, 2026, a threat actor used compromised credentials to publish a malicious Trivy v0.69.4 release, force-push 76 of 77 version tags in aquasecurity/trivy-action to credential-stealing malware, and replace all 7 tags in aquasecurity/setup-trivy with malicious commits.
On March 22, 2026, a threat actor used compromised credentials to publish malicious Trivy v0.69.5 and v0.69.6 DockerHub images. The compromise of Trivy also affected the litellm PyPI package, with malicious versions v1.82.7 and v1.82.8 published to PyPI by an attacker who gained access to the maintainer's account.
Reported impact
Users of Trivy binaries version v0.69.4 distributed via GitHub, Deb, RPM, and container images v0.69.4 and v0.69.5/v0.69.6 distributed via GHCR, ECR public, and Docker Hub were affected during the exposure windows.
The litellm malicious code collects SSH keys, environment variables, API keys, secrets, AWS/GCP/Azure/K8s credentials, crypto wallets, database passwords, SSL private keys, shell history, and CI/CD configs.
Index analysis
All malicious components, artifacts, commits, and images were removed from all sources and destinations, though they may linger in intermediary caches.
BerriAI rotated all maintainer accounts and engaged Google's Mandiant security team for investigation. The litellm proxy Docker image users were not impacted as dependencies are pinned in requirements.txt.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.