trivy github action hijacked to steal ci/cd secrets

what happened

• On 19 March 2026, an attacker using compromised credentials published a malicious Trivy v0.69.4 and repointed trivy-action and setup-trivy version tags to credential-stealing code.[1,2]
• Aqua's advisory lists trivy-action tags 0.0.1 through 0.34.2 as affected, with exposure from about 17:43 UTC on 19 March to about 05:40 UTC on 20 March (~12 hours).[1]
• The injected stealer ran before the real scan, read GitHub Actions runner memory for secrets, and searched 50+ file paths for cloud, SSH, Kubernetes and Docker credentials.[1]
• Aqua says credential rotation after the 1 March disclosure of an earlier late-February attack was not atomic, letting the attacker keep a valid token.[1,2]
• Malicious Trivy Docker Hub images v0.69.5 and v0.69.6 followed on 22 March using separately compromised credentials.[1]
• Wiz reported follow-on activity, including an npm worm dubbed CanisterWorm that leveraged stolen publish tokens, and a parallel compromise of kics-github-action.[5]
• CVE-2026-33634 is scored 9.4 (CVSS v4.0, GitHub CNA) and 8.8 (CVSS v3.1, NVD), and CISA added it to the KEV catalog on 26 March 2026.[2,3,6]
• LiteLLM says its PyPI releases 1.82.7 and 1.82.8 were compromised on 24 March 2026, and that it believes the compromise originated from the Trivy dependency in its CI/CD security-scanning workflow.[4]