Critical Supply Chain Attack Exploits Backdoored Trivy GitHub Action, Compromising Thousands of Organizations

A significant software supply chain attack, dubbed the “SANDCLOCK” campaign by TeamPCP, has been uncovered, revealing that a backdoored version of the popular `aquasecurity/trivy-action` GitHub Action was used to compromise the CI/CD pipelines of thousands of organizations. The attack, detailed by Resecurity, involved the malicious action executing within GitHub Actions runners, systematically sweeping secrets, including SSH keys, cloud credentials, Kubernetes tokens, and environment variables. The initial compromise of the Trivy GitHub Action occurred on March 19, 2026, leading to the subsequent compromise of LiteLLM, where PyPI publishing tokens were stolen and used to publish malicious `litellm` package versions on March 24, 2026. Resecurity's analysis of the attacker's victim archive indicates that 415,427 on-host secret-capture files were harvested from GitHub Actions/CI-CD runners across 898 owners and 2,038 repositories, affecting major global enterprises. This incident is critically important for any organization leveraging GitHub Actions, particularly those integrating third-party actions into their CI/CD workflows. The attack demonstrates a high level of sophistication, targeting a trusted security tool to gain deep access into development environments. The fact that a security-focused action itself became the vector of attack erodes fundamental assumptions about the safety of CI/CD pipelines. For practitioners, this means that even actions from reputable vendors require continuous vigilance and verification. The widespread impact, affecting nearly 900 organizations and over 2,000 repositories, underscores the systemic risk posed by compromised dependencies in the modern software development lifecycle. This event fits squarely within the broader, well-established trend of increasing software supply chain attacks. Over the past few years, we've seen a steady escalation in attacks targeting package managers, build systems, and CI/CD platforms, moving beyond traditional application-level vulnerabilities. The reliance on open-source components and automated workflows, while boosting productivity, simultaneously expands the attack surface. Organizations are increasingly integrating a multitude of third-party tools and actions into their build processes, often without fully understanding the transitive dependencies or the potential for a single compromised component to lead to a cascading security failure. This attack on a GitHub Action mirrors previous incidents where malicious code was injected into widely used libraries or tools, highlighting the persistent challenge of securing the entire software delivery pipeline. In practice, this incident demands immediate action and a re-evaluation of security postures for all GitHub Actions users. Organizations should prioritize auditing all third-party GitHub Actions used in their workflows, verifying their integrity and ensuring they are pinned to specific, immutable commit SHAs rather than mutable tags or branches. Implementing stricter OIDC policies and least-privilege access for CI/CD tokens is paramount. Furthermore, enhanced runtime monitoring of CI/CD environments for anomalous activity, such as unexpected network connections or file system access, becomes crucial. Developers should also consider isolating sensitive build steps and secrets, and regularly rotating credentials. The trade-off between convenience and security in CI/CD has never been starker; this attack serves as a potent reminder that trust must be earned and continuously re-verified, especially in automated pipelines handling critical assets.