SBOMator
The most sophisticated attack on a security tool to date — and why our architecture makes it impossible.
On March 19, 2026, Aqua Security's Trivy — the most widely used open-source vulnerability scanner — was compromised in a multi-phase supply chain attack. This briefing explains each attack phase and demonstrates why ESL SBOMator's architecture is fundamentally immune to every single one.
A 5-phase attack turned the world's most popular security scanner into a weapon
Attackers compromised the aqua-bot service account and pushed backdoored v0.69.4 binaries to GitHub Releases, Docker Hub, GHCR & ECR.
Force-pushed 75 of 76 version tags in trivy-action. Any workflow referencing @v0.28.0 silently ran attacker code.
Malware read /proc/<pid>/mem on runners, stealing AWS keys, SSH keys, K8s tokens, Docker creds, TLS keys — encrypted with AES-256 + RSA-4096.
Installed sysmon.py systemd service on dev machines polling a blockchain C2 every 50 minutes — resistant to takedown.
CanisterWorm compromised 47+ npm packages in under 60 seconds, turning every npm install into a propagation vector.
Three weeks before the main attack, an autonomous bot (hackerbot-claw) exploited a misconfigured pull_request_target workflow to steal a Personal Access Token (PAT). Aqua rotated credentials — but incompletely. The surviving credentials became the entry point for TeamPCP (also tracked as DeadCatx3, PCPcat, ShellForce, CipherForce) to execute the full 5-phase chain. Exfiltrated data was sent to a typosquatted domain scan.aquasecurtiy[.]org and, as fallback, staged in public GitHub repos named tpcp-docs.
The core attack vector simply does not exist
Runs as a GitHub Action inside CI/CD pipelines. References mutable version tags (@v0.28.0). Attackers force-pushed 75 tags to run malicious code — no workflow file changes needed.
Runs as a standalone commercial application on your machine. No GitHub Action, no mutable tags, no automated pipeline execution. The entire attack vector doesn't exist.
GitHub Actions version tags are mutable Git refs — anyone with push access can repoint them to arbitrary commits. Trivy users referencing aquasecurity/trivy-action@v0.28.0 unknowingly executed attacker code after the tags were poisoned. The recommended mitigation is pinning to full SHA hashes, but most organizations don't do this. ESL SBOMator never enters this equation — it's installed as a desktop/CLI application, distributed through controlled commercial channels. There are no version tags to poison, no action marketplace listing to exploit, and no automated execution triggered by upstream changes.
SBOMator never touches your pipeline secrets
Read /proc/<pid>/mem on CI runners to harvest:
AWS keys · GCP/Azure creds · SSH keys · K8s tokens · Docker creds · TLS private keys · DB passwords · Crypto wallets
Runs on your own workstation or a dedicated analysis machine. Never executes inside a CI/CD runner. Has zero access to pipeline secrets, runner memory, or cloud credentials. Architecturally impossible.
Trivy: CI Runner → Trivy Action → reads /proc/mem → SECRETS STOLEN SBOMator: Your PC → SBOMator App → scans source → SBOM report
The Trivy malware bypassed GitHub's log-masking by reading raw process memory. It encrypted stolen data with AES-256-CBC + RSA-4096 (defeating network inspection) and exfiltrated to scan.aquasecurtiy[.]org. As a fallback, it used the victim's own GitHub PAT to create a public repo for staging. None of this is possible with SBOMator because it never runs in a CI/CD context — it's a local tool that reads source files and lock files to produce an SBOM document. It doesn't have, need, or request access to any secrets.
Controlled release channels eliminate the hijacking risk
Open-source with automated release pipelines. Compromised service account → backdoored binaries auto-distributed to GitHub Releases, Docker Hub, GHCR, and Amazon ECR. No human review.
Commercial product distributed through controlled channels. No public service account to hijack, no automated release pipeline, no container registries for attackers to tamper with.
SBOMator secures its own supply chain: exact version pinning, lock files, SHA-256 hash verification, self-SBOM, Dependabot with manual PR review — no auto-merge.
SBOMator's requirements.txt uses exact pins (==) — not ranges (>=). A requirements.lock file pins direct and transitive dependencies. Builds use pip install --no-deps -r requirements.lock for deterministic resolution. The project ships its own CycloneDX SBOM (sbomator-self-sbom.cdx.json) for self-auditing. Dependabot monitors for vulnerabilities but creates PRs for human review — never auto-merging. This multi-layered approach means even if an upstream Python package were compromised, it would not silently enter a SBOMator build.
SBOMator runs, reports, and exits — no background services
Installed sysmon.py as a systemd service on developer machines. Polled a blockchain canister (ICP) every 50 minutes for C2 instructions. Takedown-resistant.
A GUI/CLI application that runs on demand. Generates SBOM → produces report → exits. No system services installed. No background processes. No elevated privileges required.
The malicious Trivy binary deployed persistence by creating a systemd service masquerading as PostgreSQL tooling. It used the Internet Computer (ICP) blockchain for C2 — a decentralized network that cannot be taken down like a traditional server. The beacon ran every 50 minutes, receiving instructions for further compromise. SBOMator has no mechanism to install system services. It doesn't write to /etc/systemd, doesn't create launch agents, and doesn't register background tasks. It is architecturally incapable of hosting a persistent backdoor — even if hypothetically compromised, it would only survive until the application is closed.
Our Supply Chain Threat Intelligence module catches the aftermath
Auto-downloads IOC lists from Wiz Security Research. Compares every package name + version against known malicious releases. Flags matches as CRITICAL.
The CanisterWorm (Phase 5) compromised 47+ npm packages. SBOMator's triple scanner (Syft + CDXgen + OSV) identifies every one in your dependency tree.
Compare SBOMs before and after to catch suspicious version bumps — exactly how Shai-Hulud and CanisterWorm propagated through version manipulation.
SBOMator's Supply Chain Threat Detection module (src/threat_intel/supply_chain_detector.py) auto-fetches IOC databases every 6 hours, comparing them against the SBOM's component list. If your project depends on any of the 47+ npm packages compromised by CanisterWorm — or any of the 796+ packages from Shai-Hulud — the HTML report surfaces a 🚨 CRITICAL SUPPLY CHAIN THREAT banner with affected package names, versions, and immediate remediation steps. Even for the Trivy binary itself — if it appeared as a component in a scanned project, SBOMator would flag the malicious v0.69.4 version. This is the ultimate irony: the tool Trivy was supposed to be is what SBOMator actually does.
Every phase blocked — and we detect the damage left behind
| Attack Phase | What Happened | Affects SBOMator? | Why Not |
|---|---|---|---|
| Phase 1 Repo Takeover | Hijacked service account pushed backdoored binaries | ❌ IMMUNE | Commercial distribution, no public repo to hijack |
| Phase 2 Tag Poisoning | 75 GitHub Action tags repointed to malicious commits | ❌ IMMUNE | Not a GitHub Action — zero attack surface |
| Phase 3 Credential Theft | Read CI runner memory, stole all cloud secrets | ❌ IMMUNE | Never runs inside CI/CD runners |
| Phase 4 Persistent Backdoor | Installed systemd service with blockchain C2 | ❌ IMMUNE | On-demand tool, no services installed |
| Phase 5 npm Worm | 47+ packages compromised in 60 seconds | ❌ IMMUNE | Python-based with pinned deps — and detects it! |
Trivy was compromised because it operates as an open-source GitHub Action running inside CI/CD pipelines with access to secrets. ESL SBOMator is a standalone commercial tool that runs outside the pipeline — architecturally immune to every phase, and capable of detecting the aftermath.
The Trivy attack is part of a clear escalation: SolarWinds (2020) → Codecov (2021) → ua-parser-js (2021) → tj-actions (2025) → Trivy (2026). Attackers are systematically targeting security tools themselves. By choosing ESL SBOMator — a standalone, commercially distributed tool with its own hardened supply chain — your organization eliminates the entire class of CI/CD pipeline weaponization attacks while gaining the ability to detect when others fall victim.
📍 Ha-Nagar 24 A, Hod Hasharon, Israel