Trivy Supply Chain Attack Spreads, Triggering Self-Spreading Worm Across npm Packages

A critical security incident is unfolding across the software development ecosystem, stemming from a compromise of the widely-used Trivy vulnerability scanner. Initial reports indicated malicious artifacts were present in affected registries, but the situation has rapidly escalated to include the compromise of numerous npm packages and the emergence of a self-propagating worm dubbed “CanisterWorm.” The attack highlights the growing risks inherent in software supply chains and the potential for widespread disruption.

The initial breach, discovered on March 19th, involved a threat actor exploiting a compromised credential to gain access to Trivy’s systems. Trivy maintainer Itay Shakury confirmed the compromise and stated that all recent releases now point to a safe version, but the damage was already done. Attackers force-pushed malicious dependencies to 75 Trivy-action tags and seven setup-trivy tags, effectively hijacking the build process for anyone using those versions.

The Expanding Attack Surface: From Trivy to npm

The fallout from the Trivy compromise quickly spread to the npm package registry. Security researchers at Aikido Security have identified a follow-on attack leveraging stolen npm tokens to inject malicious code into a growing number of packages. This malicious code utilizes a postinstall hook to execute a loader, which then retrieves a Python backdoor from an ICP canister – marking the first publicly documented abuse of this technology for command-and-control (C2) purposes. The backdoor establishes persistence through a systemd user service, disguised as PostgreSQL tooling (“pgmon”), ensuring it automatically restarts even if terminated.

A particularly concerning aspect of this attack is the “deploy.js” file used by the attackers. This standalone tool, run with stolen tokens, allows for programmatic infection of all packages accessible with those credentials, maximizing the potential blast radius. Aikido Security reports the worm’s code, assessed to be generated using an AI tool, is remarkably unhidden, suggesting a focus on speed and scale over stealth.

The situation took a further turn with the discovery of a self-propagating variant of CanisterWorm within the “@teale.io/eslint-config” package (versions 1.8.11 and 1.8.12). According to Charlie Eriksen of Aikido Security, “Every developer or CI pipeline that installs this package and has an npm token accessible becomes an unwitting propagation vector. Their packages get infected, their downstream users install those, and if any of them have tokens, the cycle repeats.” Currently, 28 packages within the @EmilGroup scope and 16 within the @opengov scope are confirmed to be affected, with the attack attributed to a cloud-focused cybercriminal operation known as TeamPCP.

What steps can developers take to mitigate this risk? Are current software supply chain security practices sufficient to prevent attacks of this nature?

Root Cause: Hardcoded Secrets and Insufficient Token Rotation

Investigations revealed that the root cause of the Trivy compromise stemmed from inadvertently hardcoded authentication secrets within Trivy’s development and deployment pipelines. This allowed attackers to bypass standard security measures and force-push malicious updates without triggering typical GitHub alerts. While maintainers rotated tokens after the initial compromise of the Aqua Trivy VS Code extension, the process wasn’t “atomic,” leaving residual credential artifacts vulnerable to exploitation. Socket researchers noted that force-pushing tags bypassed commit history and notifications, enabling the attackers to operate undetected.

Security firms Socket and Wiz have determined that the malware triggered by the compromised Trivy tags actively searches for sensitive information within development pipelines and on developer machines, including GitHub tokens, cloud credentials, SSH keys, and Kubernetes tokens. This data is then encrypted and exfiltrated to an attacker-controlled server. The impact is significant: any CI/CD pipeline utilizing the compromised Trivy versions immediately executes malicious code upon scanning.

This incident serves as a critical wake-up call for the software development community. Proactive security measures and a heightened awareness of supply chain risks are essential to protect against future attacks.

Share this article with your colleagues to help raise awareness of this critical security threat. What further steps do you think the industry needs to take to improve software supply chain security?