[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAPgc6UDfFN0mzSdaweqbqVGrrCcDH8wkEiEKhAVm+o1cqk2+nw@mail.gmail.com>
Date: Tue, 24 Mar 2026 03:31:21 +1300
From: Jeremy Utiera <jeremyutiera@...il.com>
To: oss-security@...ts.openwall.com
Subject: Re: Trivy github actions repo compromised, infostealer added
On Sat, 21 Mar 2026 at 20:40, Alan Coopersmith
<alan.coopersmith@...cle.com> wrote:
>
> https://socket.dev/blog/trivy-under-attack-again-github-actions-compromise
> reports that a compromised credential with write access to the repository
> was used to modify 75 out of 76 version tags in the aquasecurity/trivy-action
> repository, the official GitHub Action for running Trivy vulnerability scans in
> CI/CD pipelines.
Of note, this attack is still on-going and the extent of Trivy's
compromise seems to be growing. After the above was announced, further
malicious actions were taken by the third party targeting them.
https://socket.dev/blog/trivy-docker-images-compromised details how
additional compromised Trivy artifacts (image tags `0.69.5` and
`0.69.6`) were published to Docker Hub on March 22 without
corresponding GitHub releases or tags.
Trivy published a GitHub Security Advisory and has since updated it
with the new Docker Hub compromise information:
https://github.com/aquasecurity/trivy/security/advisories/GHSA-69fq-xp46-6x23
Cheers,
Jeremy
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
