The Scanner That Stabbed You: How One Stolen Service Account Unleashed a Supply Chain Worm + Video

By /

Listen to this Post

Featured Image

Introduction:

In a chilling escalation of software supply chain attacks, a single compromised service account belonging to Aqua Security became the master key to a sprawling campaign that weaponized trusted developer tools. Threat actors, identified as TeamPCP and now coordinating with LAPSUS$ and a new ransomware group called “Vect,” demonstrated that the tools meant to secure your code can be repurposed to steal it, using trusted open-source projects as the delivery mechanism for a worm-like propagation.

Learning Objectives:

  • Understand the anatomy of a supply chain attack targeting CI/CD pipelines and container registries.
  • Learn to detect and mitigate malicious code injection in GitHub Actions, npm packages, and PyPI libraries.
  • Implement hardening techniques for service accounts and secrets management to prevent lateral movement and ransomware deployment.

You Should Know:

  1. Dissecting the Trivy Action Compromise: A Case Study in Pipeline Poisoning
    The attack began with the theft of an Aqua Security service account, which provided privileged access to the Trivy GitHub repository—a popular vulnerability scanner with over 33,000 stars. The attackers, TeamPCP, leveraged this access to force-push malicious code to 76 out of 77 version tags of the `trivy-action` repository. This action, used in thousands of CI/CD pipelines to scan for vulnerabilities, was subtly altered. Instead of merely reporting vulnerabilities, the modified action exfiltrated environment secrets (such as NPM_TOKEN, AWS_ACCESS_KEY_ID, and DOCKERHUB_PASSWORD) from any runner executing the action.

Step-by-step guide to detecting this compromise and securing your pipeline:

  1. Audit GitHub Actions Usage: Run a `grep` search across your repository to identify all uses of aquasecurity/trivy-action. 
    Linux/macOS
grep -r "aquasecurity/trivy-action" .github/workflows/

On Windows (PowerShell):

Select-String -Path .github/workflows/.yml -Pattern "aquasecurity/trivy-action"

2. Pin Actions by Commit Hash: Instead of using `@v1` or @main, pin the action to a specific, verified commit SHA to prevent automatic pulling of malicious tags. For example:

- name: Run Trivy scanner
uses: aquasecurity/trivy-action@a1b2c3d4e5f67890...  Full commit SHA

3. Review GitHub Audit Logs: Check for unauthorized `force_push` events on your repositories or any repository you depend on.

 Using GitHub CLI
gh api repos/:owner/:repo/events --jq '.[] | select(.type=="PushEvent" and .payload.forced==true)'

4. Rotate Exposed Secrets Immediately: If you ran any pipeline using the affected tags (from March 2026 onwards), assume all secrets passed to that runner are compromised. Rotate them via your cloud provider CLI.

 AWS CLI example
aws secretsmanager rotate-secret --secret-id my-secret
 Azure CLI example
az keyvault secret set --name "my-secret" --vault-name "MyVault" --value "new-value"
  1. The NPM Worm: From Stolen Tokens to 64-Package Propagation
    With stolen npm tokens exfiltrated from compromised pipelines, the attackers pivoted to the JavaScript ecosystem. They used these tokens to publish malicious versions to over 64 npm packages. This wasn’t just a single point of compromise; it was a worm. Any project that installed one of these poisoned packages would have its own npm tokens stolen, leading to an exponential spread across the open-source landscape.

Step-by-step guide to verifying npm package integrity and preventing token theft:

  1. List Installed Packages and Check for Recent Updates: 
    npm list --depth=0 --json | jq '.dependencies | keys[]' | xargs -I {} npm view {} time --json | jq '.[] | select(.modified > "2026-03-01")'

    This command lists top-level dependencies and filters for those modified after March 1st, 2026—the campaign’s start window.

2. Prevent npm Token Exposure in CI/CD:

  • Avoid using `NPM_TOKEN` as a plain environment variable if possible. Use granular access tokens limited to a single package and rotate them frequently.
  • Configure your `~/.npmrc` to use a CI/CD-specific scope: 
    //registry.npmjs.org/:_authToken=${NPM_TOKEN}
@my-scope:registry=https://registry.npmjs.org/
  • Use OIDC (OpenID Connect) to authenticate with npm from GitHub Actions instead of long-lived tokens. This eliminates the need to store a persistent secret. 
    </li>
<li>name: Publish to npm
uses: actions/setup-node@v4
with:
node-version: '18.x'
registry-url: 'https://registry.npmjs.org'
env:
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}  Still a secret, but OIDC is better

3. LiteLLM: The First Major AI Infrastructure Target

On March 24th, the campaign expanded to the AI supply chain. LiteLLM, a library used to unify calls to dozens of LLM providers (OpenAI, Anthropic, etc.), saw two malicious PyPI releases. This marked a strategic shift—the attackers are now targeting the very infrastructure companies use to build AI agents. Compromising LiteLLM could allow attackers to intercept API keys to AI models, manipulate prompts, or exfiltrate sensitive data being passed to LLMs.

Step-by-step guide to hardening your AI pipeline against supply chain attacks:

  1. Verify PyPI Package Signatures: PyPI now supports attestations. Use `pip-audit` or `twine` to verify signatures before installation. 
    Install pip-audit
pip install pip-audit
Audit a specific package for vulnerabilities and provenance
pip-audit --requirement requirements.txt

2. Implement Virtual Environments and Dependency Pinning:

 Create a lock file to ensure exact versions
pip freeze > requirements-locked.txt
 Install from the locked file
pip install -r requirements-locked.txt --require-hashes

3. Monitor AI-Specific Secrets: Use tools like `truffleHog` to scan your environment for leaked LLM API keys, which are often stored insecurely in environment variables or code.

 Scan a local repository for secrets (including AI tokens)
trufflehog filesystem . --only-verified --regex

On Windows, run the same command via WSL or the compiled truffleHog binary.

4. Defensive Hardening: Securing Service Accounts and OIDC

The initial breach vector—a stolen Aqua Security service account—highlights the catastrophic failure of static credential management. To prevent a similar scenario, organizations must adopt ephemeral, workload-based authentication.

Step-by-step guide to replacing static service accounts with OIDC:

  1. For AWS: Configure GitHub Actions to assume an IAM role without storing long-term credentials. 
    </li>
</ol>

- name: Configure AWS Credentials
uses: aws-actions/configure-aws-credentials@v4
with:
role-to-assume: arn:aws:iam::123456789012:role/GitHubActionRole
aws-region: us-east-1

    2. For Azure: Use federated credentials for service principals.

     Create a service principal with federated credential
az ad sp create --name myGitHubSp
az ad app federated-credential create --id $appId --parameters '{"name":"GitHubActions","issuer":"https://token.actions.githubusercontent.com","subject":"repo:owner/repo:environment:prod"}'

    3. For Cloud Providers (General): Enforce a policy that no long-term access keys are stored in CI/CD secrets for production environments. Use a script to audit for existing static keys.

     List all IAM users with active access keys in AWS
aws iam list-users --query 'Users[].UserName' | xargs -I {} aws iam list-access-keys --user-name {}

    What Undercode Say:

    • Trust is the New Vulnerability: The campaign weaponizes trust by compromising the very scanners (Trivy, KICS) and infrastructure (LiteLLM) designed to enforce security, proving that defensive tools are prime targets for sophisticated attackers.
    • Pipeline as the Perimeter: The attack demonstrates that the CI/CD pipeline is now the new perimeter. Once the pipeline is compromised, it acts as a launchpad for lateral movement into cloud environments and downstream open-source ecosystems.
    • The Rise of Ransomware-Enabled Supply Chain Attacks: The coordination with LAPSUS$ and the Vect ransomware group marks a dangerous convergence. Attackers are no longer just stealing data for resale; they are systematically planting backdoors to enable future, targeted ransomware campaigns against enterprises that trust these open-source components.

    The shift from targeting production servers to targeting the pre-production pipeline represents a fundamental change in the threat landscape. By compromising the tools that developers trust implicitly—the scanners, the builders, the AI orchestrators—attackers achieve massive scale and plausible deniability. The use of a single stolen service account to seed a worm across npm, Docker Hub, and PyPI within two weeks demonstrates not only technical skill but also a deep understanding of the interconnected nature of modern development. This incident is a harbinger of a future where the “build” phase is as heavily contested as the “runtime” phase, demanding a zero-trust approach to CI/CD tools and a complete overhaul of how we handle machine identities in the software supply chain.

    ▶️ Related Video (78% Match):

    🎯Let’s Practice For Free:

    IT/Security Reporter URL:

    Reported By: Vimokumar The – Hackers Feeds
    Extra Hub: Undercode MoN
    Basic Verification: Pass ✅

    🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]

    💬 Whatsapp | 💬 Telegram

    📢 Follow UndercodeTesting & Stay Tuned:

    𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky

Related Posts: