Trivy Docker images 0.69.5/0.69.6 confirmed compromised
TL;DR — Newly published aquasec/trivy Docker Hub tags were compromised, meaning CI jobs that pull Trivy by mutable tag may have executed an infostealer inside build runners.
What happened
Trivy is a widely used open-source vulnerability scanner for containers and related artifacts, commonly embedded into CI/CD pipelines to gate builds and releases.
Socket reported that new Trivy image tags 0.69.5 and 0.69.6 were pushed to Docker Hub without corresponding GitHub releases/tags, and that these images contain indicators tied to the TeamPCP infostealer campaign; Socket also notes that the Docker Hub latest tag points to 0.69.6, which is compromised. (socket.dev)
Socket’s analysis calls out concrete compromise artifacts including the typosquatted C2 domain scan.aquasecurtiy.org, exfiltration artifacts (payload.enc, tpcp.tar.gz), and references to a fallback GitHub repository (tpcp-docs). (socket.dev)
Separately, StepSecurity states it confirmed the C2 domain by extracting the Trivy binaries from aquasec/trivy:0.69.5 and aquasec/trivy:0.69.6 and finding the hardcoded domain via strings analysis (validated in a controlled GitHub Actions workflow). (stepsecurity.io)
This is an S-tier supply-chain failure mode for platform teams: scanners and CI helpers run in high-trust contexts (runner secrets, repo tokens, registry credentials), and Docker tags are mutable, so “we pinned a version tag” is not a real integrity control during an incident. (socket.dev)
Who is impacted
- Any org that pulled or executed
aquasec/trivyfrom Docker Hub by tag (especiallylatest) during the window where compromised tags were available. (socket.dev) - CI/CD environments where Trivy runs with access to secrets (e.g.,
${{ secrets.* }},GITHUB_TOKEN, cloud credentials, registry credentials). - Downstream systems that automatically rebuild or republish images/tools by “pull latest scanner” patterns (supply-chain amplification risk). (socket.dev)
| Artifact | Status (as reported) | Notes |
|---|---|---|
aquasec/trivy:0.69.3 | Last known clean (per Socket) | Socket states 0.69.3 remains the last known clean release. (socket.dev) |
aquasec/trivy:0.69.4 | Compromised | Socket describes 0.69.4 as the initial compromised release (since removed). (socket.dev) |
aquasec/trivy:0.69.5 / 0.69.6 | Compromised | Socket reports both are compromised; StepSecurity states it confirmed the hardcoded C2 domain in the binaries extracted from these images. (socket.dev) |
aquasec/trivy:latest | Compromised (at time of reporting) | Socket reports latest points to 0.69.6. (socket.dev) |
What to do now
- Follow vendor remediation guidance and assume a CI/CD execution of a compromised scanner image is a credentials-exposure event.
- Avoid relying on Docker tags for integrity; Socket explicitly warns that Docker Hub tags are not immutable and orgs should not rely solely on tag names. (socket.dev)
- If you suspect your org executed compromised Trivy artifacts, use the vendor’s incident guidance:
"If you suspect you were running a compromised version, treat all pipeline secrets as compromised and rotate immediately." (github.com)
- Consider blocking network indicators the vendor called out:
"We also recommend that you block the C2 domain
scan[.]aquasecurtiy[.]organd IP45.148.10.212at your network perimeter." (github.com) - Inventory and triage impact fast:
- Identify pipelines that reference
aquasec/trivy(and whether they pulled by tag vs digest). - Review CI logs for suspicious outbound calls and unexpected archive/artifact creation consistent with exfiltration tooling.
- Identify pipelines that reference
- For incident narrative and containment assumptions, note Aqua’s own acknowledgment that the March 19 event was a follow-on where initial containment was incomplete:
"Our containment of the first incident was incomplete." (github.com)
Content is AI-assisted and reviewed by our team, but issues may be missed and best practices evolve rapidly, send corrections to [email protected]. Always consult official documentation and validate key implementation decisions before making design or security choices.