When the Scanner Becomes the Weapon: NHI Lessons from the Trivy / TeamPCP Supply Chain Attack

The attack used access retained from an earlier incident that was only partially contained. TeamPCP spoofed commits as legitimate maintainers - pushing imposter commits attributed to rauchg (to actions/checkout) and DmitriyLewen (to aquasecurity/trivy). At 17:43:37 UTC, the malicious v0.69.4 tag was pushed, triggering an automated release pipeline that published backdoored binaries to GitHub Releases, Docker Hub, GHCR, and ECR.

TeamPCP compromised the aqua-bot service account - a non-human identity with broad write permissions across the Aqua Security GitHub organization. From this single NHI, attackers pushed malicious workflows to three repositories and stole GPG signing keys, Docker Hub tokens, Twitter credentials, and Slack tokens, exfiltrated via a Cloudflare Tunnel C2.

The malicious GitHub Actions payload scraped the runner's GITHUB_TOKEN from process memory, then swept 50+ filesystem paths for AWS, GCP, and Azure credentials, Kubernetes tokens, SSH keys, and cryptocurrency wallets. Harvested data was encrypted with AES-256-CBC and RSA-4096 hybrid encryption then bundled for exfiltration. This is a direct harvest of non-human identities operating inside CI/CD pipelines.

Primary exfiltration went to the typosquatted domain scan.aquasecurtiy[.]org (note the misspelling), resolving to 45.148.10.212. As a fallback, stolen GITHUB_TOKENs created tpcp-docs repositories in each victim's GitHub organization and uploaded stolen credentials as release assets - weaponizing the victim's own NHI against them.

On developer machines (detected by checking GITHUB_ACTIONS != "true"), the malicious Trivy binary installed persistence by writing a Python dropper to ~/.config/systemd/user/sysmon.py and registering it as a systemd unit. The dropper polled an ICP-hosted C2 canister and executed any payload it received.

Check whether your organization pulled or executed Trivy v0.69.4, v0.69.5, or v0.69.6 from any source. Review workflow run logs from March 19-23 for signs of compromise. Search for repositories named tpcp-docs in your GitHub organizations - their presence indicates successful exfiltration.

Rotate any cloud credentials (AWS, GCP, Azure), Kubernetes tokens, SSH keys, and API tokens present in environments running the compromised Actions or Trivy binary. The TeamPCP stealer swept 50+ credential paths. Assume all were captured.

Replace all version-tag references with immutable full commit SHA hashes. A version tag like @v0.69.0 can be silently redirected; a full SHA cannot be forged. Use tools like StepSecurity's Harden-Runner to automate SHA pinning across your organization's workflows.

Set permissions: read-all as your organization's default workflow permission. Grant explicit minimal write permissions only on specific jobs that require them. This prevents harvested tokens from being used to create repositories or publish release assets.

Audit every bot, service account, and automation identity. Each should hold the minimum permissions for its specific function - scoped to a single repository and a narrow action set. Bot accounts with organization-level write access are supply chain attack force multipliers.

Human identity programs have MFA, conditional access, and risk scoring as table stakes. Non-human identities have none of these by default. Establish equivalent controls: detect anomalous credential usage, flag secrets unused for 90+ days, and alert on any NHI creating repositories or publishing to registries outside established behavioral baselines.