Trivy supply chain compromised via credential theft
A threat actor used compromised credentials to publish malicious versions of Trivy, a security scanning tool, through multiple distribution channels including GitHub releases, Docker Hub, and GitHub Actions. The malicious code collected sensitive credentials and other secrets from affected systems, subsequently compromising downstream projects including BerriAI's litellm package.
What happened
On March 19, 2026, a threat actor used compromised credentials to publish a malicious Trivy v0.69.4 release and force-push 76 of 77 version tags in aquasecurity/trivy-action to credential-stealing malware, and replaced all 7 tags in aquasecurity/setup-trivy with malicious commits.
On March 22, 2026, the threat actor published malicious Trivy v0.69.5 and v0.69.6 DockerHub images.
The malicious code collected SSH keys, environment variables, API keys, secrets, AWS/GCP/Azure/K8s credentials, crypto wallets, database passwords, SSL private keys, shell history, and CI/CD configs.
Reported impact
BerriAI's litellm PyPI package versions 1.82.7 and 1.82.8 were compromised as a result of the Trivy supply chain attack, with malicious versions published to PyPI that stole credentials and exfiltrated them to an attacker-controlled server.
Index analysis
Exposure windows varied by component: Trivy v0.69.4 was exposed for approximately 3 hours, trivy-action for approximately 12 hours, setup-trivy for approximately 4 hours, and DockerHub images v0.69.5 and v0.69.6 for approximately 10 hours.
All malicious components, artifacts, commits, and other elements were removed from all sources and destinations, though they may linger in intermediary caches.
Governance controls
GitHub's immutable releases feature, enabled March 3, 2026, protected Trivy version v0.69.3 and earlier from tampering.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.