Malicious Aqua Trivy VS Code Extension Published to OpenVSX After GitHub Token Compromise

Threat actors inserted unauthorized code into the Aqua Trivy VS Code extension distributed via the OpenVSX registry, with the tampered builds appearing as versions 1.8.12 and 1.8.13 under the aquasecurityofficial.trivy-vulnerability-scanner namespace. Reporting indicates the malicious code was not present in the public GitHub repository (versions up to 1.8.11 matched), and the injected logic was designed to weaponize locally installed AI coding assistants—invoking tools such as Claude, Codex, Gemini, GitHub Copilot CLI, and Kiro CLI with permissive options—to perform host reconnaissance and collect data while running detached in the background and suppressing output to avoid user visibility.

Researchers tied the extension tampering to a broader automated campaign targeting GitHub Actions workflows, where insecure CI/CD configurations and overprivileged tokens can enable repository takeover and downstream supply-chain abuse. Socket.dev flagged the suspicious OpenVSX extension behavior, while StepSecurity documented that the wider bot-driven GitHub Actions activity led to theft of a personal access token (PAT) and subsequent takeover of Aqua’s Trivy GitHub repository—providing the access needed to publish the modified extension. Separate reporting on the hackerbot-claw campaign described autonomous exploitation of misconfigured pull_request_target workflows to achieve runner RCE and exfiltrate write-capable GITHUB_TOKENs, reinforcing the same core risk: CI/CD token exposure and workflow misconfigurations can rapidly translate into codebase control and malicious artifact distribution.