Trivy under attack again: Widespread GitHub Actions tag compromise secrets
1–10 of 97 posts
Re: Trivy under attack again: Widespread GitHub Actions tag compromise secrets
#2Recent and related:
Trivy ecosystem supply chain temporarily compromised - https://news.ycombinator.com/item?id=47450142 - March 2026 (35 comments)
Re: Trivy under attack again: Widespread GitHub Actions tag compromise secrets
#3> On March 22, 2026, a threat actor used compromised credentials to publish a malicious Trivy v0.69.5 and v0.69.6 DockerHub images. (https://github.com/aquasecurity/trivy/security/advisories/GH...)
So the first incident was on March 19th and the second incident is March 22nd —- evidently the attackers maintained persistence through maybe two separate credential rotation efforts.
Re: Trivy under attack again: Widespread GitHub Actions tag compromise secrets
#4Friendly reminder that just because someone is building security software it doesn't mean they are competent and won't cause more harm than good.
Every month the security team wants me to give full code or cloud access to some new scanner they want to trial. They love the fancy dashboards and lengthy reports but if I allowed just 10% of what they wanted we would be pwned on the regular...
Re: Trivy under attack again: Widespread GitHub Actions tag compromise secrets
#5/s But I thought npm was the issue, and all of this couldn't happen anywhere else?!
Re: Trivy under attack again: Widespread GitHub Actions tag compromise secrets
#6fatiguing
Re: Trivy under attack again: Widespread GitHub Actions tag compromise secrets
#7/s But I thought npm was the issue, and all of this couldn't happen anywhere else?!
What if we just rebuild everything from scratch with AI? No more supply chain attacks!
Re: Trivy under attack again: Widespread GitHub Actions tag compromise secrets
#8Wasn't this discovered already last week, on Friday, that the threat actor had replaced the legit images with malware images? And republished 75 out of 76 tags?
Re: Trivy under attack again: Widespread GitHub Actions tag compromise secrets
#9Friendly reminder that just because someone is building security software it doesn't mean they are competent and won't cause more harm than good. Every month the security team wants me to give full code or cloud access to some new scanner they want to trial. They love the fancy dashboards and lengthy reports but if I allowed just 10% of what they wanted we would be pwned on the regular...
Most of corporate security nowadays involves "endpoint security solutions" installed on all devices, servers and VMs, piping everything into an AI-powered dashboard so we can move fast and break everything.
Re: Trivy under attack again: Widespread GitHub Actions tag compromise secrets
#10I always run such tools inside sandboxes to limit the blast radius.