[<prev] [next>] [day] [month] [year] [list]
Message-ID: <8163893e-6611-4189-baac-bce24d03640d@oracle.com>
Date: Fri, 20 Mar 2026 17:28:15 -0700
From: Alan Coopersmith <alan.coopersmith@...cle.com>
To: oss-security@...ts.openwall.com
Subject: Trivy github actions repo compromised, infostealer
added
https://socket.dev/blog/trivy-under-attack-again-github-actions-compromise
reports that a compromised credential with write access to the repository
was used to modify 75 out of 76 version tags in the aquasecurity/trivy-action
repository, the official GitHub Action for running Trivy vulnerability scans in
CI/CD pipelines.
The tags were modified to point to a commit that runs an infostealer malware
before running the expected vulnerability scan.
The blog post provides far more detail on what the injected malware does,
how the attackers modified the tags and tried to hide their changes, and
how this was detected.
--
-Alan Coopersmith- alan.coopersmith@...cle.com
Oracle Solaris Engineering - https://blogs.oracle.com/solaris
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
