How it unfolded

1. 1

   Tag-write privilege force-overwrites 76 of 77 trivy-action tags

   Using credentials with tag-write access, the actors force-overwrote almost every release tag in aquasecurity/trivy-action (76 of 77) and all seven tags in aquasecurity/setup-trivy, redirecting every consumer pinning by tag to malicious commits — with no visible change in release metadata.

2. 2

   Checkmarx's KICS Action is compromised via stolen PATs

   Days later, on March 23, the actors used stolen personal access tokens to compromise Checkmarx's KICS GitHub Action the same way, alongside OpenVSX extensions and LiteLLM on PyPI.

3. 3

   Stolen npm tokens chain into the next project

   Credentials harvested from the KICS compromise — specifically npm tokens — were reused to hijack @bitwarden/cli.

4. 4

   A separate wave uses plain script injection

   elementary-data was compromised through ordinary Actions script injection, a different technique from the tag-overwrite chain used elsewhere in the campaign.

5. 5

   Each compromised project funds the next wave

   Researchers traced at least seven distinct waves, with each compromise's stolen credentials chaining directly into the next target rather than the campaign relying on a single initial foothold.