Executive Summary
In late February 2026, threat actors compromised versions 1.8.12 and 1.8.13 of the Aqua Trivy VS Code extension on the OpenVSX registry. The attackers injected malicious code that exploited local AI coding tools—such as Claude, Codex, Gemini, GitHub Copilot CLI, and Kiro CLI—to perform unauthorized data collection on developers' machines. This code operated silently, leaving no visible alerts, and was removed from OpenVSX on February 28, 2026. (cryptika.com)
This incident underscores the evolving nature of supply chain attacks, particularly the novel use of AI tools to facilitate data exfiltration. It highlights the critical need for developers and organizations to implement robust security measures, including regular audits of third-party extensions and vigilant monitoring of development environments.
Why This Matters Now
The Aqua Trivy incident exemplifies the increasing sophistication of supply chain attacks, especially those leveraging AI technologies. As AI tools become more integrated into development workflows, they present new vectors for exploitation. Organizations must prioritize securing their software supply chains to prevent similar breaches.
Attack Path Analysis
The attack began with the compromise of Aqua Security's Trivy vulnerability scanner, allowing attackers to distribute trojanized versions containing an infostealer. Using the stolen credentials, the attackers escalated privileges to access and deface internal repositories. They then moved laterally by compromising npm packages to distribute a self-propagating worm. Command and control were established through the deployment of malicious artifacts via Docker Hub. The attackers exfiltrated sensitive data from compromised systems. Finally, they deployed a wiper malware to destroy Kubernetes clusters, causing significant operational disruption.
Kill Chain Progression
Initial Compromise
Description
Attackers compromised Aqua Security's Trivy vulnerability scanner, embedding an infostealer in trojanized versions.
Related CVEs
CVE-2026-28353
CVSS 10An information disclosure vulnerability in Trivy VSCode Extension v1.8.12 allows malicious code to exploit AI agents to exfiltrate secrets.
Affected Products:
Aqua Security Trivy VSCode Extension – 1.8.12
Exploit Status:
exploited in the wildCVE-2026-26189
CVSS 8.1A command injection vulnerability in aquasecurity/trivy-action versions 0.31.0 through 0.33.1 allows arbitrary code execution in GitHub Actions runners.
Affected Products:
Aqua Security Trivy GitHub Action – 0.31.0, 0.31.1, 0.32.0, 0.32.1, 0.33.0, 0.33.1
Exploit Status:
proof of concept
MITRE ATT&CK® Techniques
Compromise Software Supply Chain
Deploy Container
Escape to Host
Container Service
Compromise Software Dependencies and Development Tools
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Ensure all system components are protected from known vulnerabilities
Control ID: 6.2
NYDFS 23 NYCRR 500 – Cybersecurity Policy
Control ID: 500.03
DORA – ICT Risk Management Framework
Control ID: Article 5
CISA ZTMM 2.0 – Supply Chain Risk Management
Control ID: 3.1
NIS2 Directive – Cybersecurity Risk Management Measures
Control ID: Article 21
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Computer Software/Engineering
Supply chain attacks targeting Trivy Docker containers directly compromise software development pipelines, enabling infostealer deployment and Kubernetes cluster wiping across development environments.
Information Technology/IT
Malicious Docker Hub artifacts exploit containerized infrastructure dependencies, triggering worm propagation and Kubernetes wipers that devastate cloud-native IT operations and security frameworks.
Computer/Network Security
Trivy security tool compromise creates trust erosion in vulnerability scanning infrastructure while demonstrating advanced supply chain attack vectors requiring enhanced container image verification.
Financial Services
Kubernetes wiper capabilities threaten critical financial infrastructure running containerized applications, potentially disrupting trading systems and violating PCI compliance through east-west traffic exploitation.
Sources
- Trivy Hack Spreads Infostealer via Docker, Triggers Worm and Kubernetes Wiperhttps://thehackernews.com/2026/03/trivy-hack-spreads-infostealer-via.htmlVerified
- CVE-2026-28353: Trivy VSCode Extension Info Disclosurehttps://www.sentinelone.com/vulnerability-database/cve-2026-28353/Verified
- CVE-2026-26189: Trivy Action Command Injection Vulnerabilityhttps://www.sentinelone.com/vulnerability-database/cve-2026-26189/Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Aviatrix Zero Trust CNSF is pertinent to this incident as it could have limited the attacker's ability to move laterally and exfiltrate data by enforcing strict segmentation and identity-aware access controls.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: The attacker's ability to distribute malicious versions of the scanner may have been constrained, reducing the scope of initial compromise.
Control: Zero Trust Segmentation
Mitigation: The attacker's ability to escalate privileges may have been constrained, reducing the scope of unauthorized access.
Control: East-West Traffic Security
Mitigation: The attacker's ability to move laterally across systems may have been constrained, reducing the spread of the worm.
Control: Multicloud Visibility & Control
Mitigation: The attacker's ability to establish command and control channels may have been constrained, reducing the effectiveness of remote control.
Control: Egress Security & Policy Enforcement
Mitigation: The attacker's ability to exfiltrate sensitive data may have been constrained, reducing data loss.
The attacker's ability to deploy destructive malware may have been constrained, reducing operational disruption.
Impact at a Glance
Affected Business Functions
- Software Development
- Continuous Integration/Continuous Deployment (CI/CD) Pipelines
- Container Security
- Infrastructure as Code (IaC) Management
Estimated downtime: 7 days
Estimated loss: $500,000
Potential exposure of sensitive developer credentials, API keys, and proprietary source code.
Recommended Actions
Key Takeaways & Next Steps
- • Implement Zero Trust Segmentation to enforce least privilege access and limit lateral movement.
- • Utilize East-West Traffic Security to monitor and control internal traffic, detecting unauthorized communications.
- • Deploy Multicloud Visibility & Control solutions to gain comprehensive insights across cloud environments and detect anomalies.
- • Enforce Egress Security & Policy Enforcement to control outbound traffic and prevent data exfiltration.
- • Regularly audit and monitor service accounts and credentials to detect and respond to unauthorized access promptly.
