Aquasecurity/Trivy GitHub Repository and Homebrew Cask Compromised (again) (opens in new tab)

(opensourcemalware.com)

16 pointsmmsc6d ago4 comments

4 comments

mmscOP6d ago

The offending commit seems to be: https://github.com/aquasecurity/trivy/commit/1885610c6a34811... which updates the action to `actions/checkout@70379aad1a8b40919ce8b382d3cd7d0315cde1d0 # v6.0.2`. https://github.com/actions/checkout/commit/70379aad1a8b40919... is not actually in `actions/checkout` but a fork, and it pulls malicious code from the typo-squatted "scan.aquasecurtiy.org" (note the _tiy_).

Any system with Trivy 0.69.4 on it (and being run) can be assumed to be compromised.

Current GitHub discussion (the old discussion was removed by the attacker): https://github.com/aquasecurity/trivy/discussions/10420

jl65d ago

Any recommendations for Trivy alternatives to use while Aqua rebuilds their reputation?

Grype, Clair

j / k navigate · click thread line to collapse

mmscOP6d ago

Any system with Trivy 0.69.4 on it (and being run) can be assumed to be compromised.

Current GitHub discussion (the old discussion was removed by the attacker): https://github.com/aquasecurity/trivy/discussions/10420

jl65d ago

Any recommendations for Trivy alternatives to use while Aqua rebuilds their reputation?

Grype, Clair

j / k navigate · click thread line to collapse