Of course, every entity is ultimately accountable for its own security, including assigning a level of trust to any dependencies, so it’s ultimately no excuse, but getting hit by a supply chain attack does evoke a little more sympathy (“at least I did my bit right”), and I feel like the ambiguous wording of the title is trying to access some of that sympathy.
In my experience that is definitely not true, and I've never heard anyone use it that way. Even though you are correct in who the target was.
"Trivy Supply Chain Attack Spreads, Triggers Self-Spreading CanisterWorm Across 47 npm Packages"
https://it.slashdot.org/story/26/03/22/0039257/trivy-supply-...
(IOW You definitely should still hash-pin actions, but doing so isn’t sufficient in all circumstances.)
Disclosure: I’m the founder of Socket.
The Go binary was also compromised, but there's almost no information what the compromised binary did. Did it drop a python script? Did it do direct scanning?
If trivy docker image was used, what's the scope (it does not include python).
This is a very old vulnerability, and to see companies falling for it is mental.
The year is 2026 and companies are still using tag over hash. It is well known that you can release different code under the same tag without alerting users.
I only clicked on a handful of accounts but several of them have plausibly real looking profiles.
https://github.com/Hancie123/mero_hostel_backend/commit/4bcb...
There are hundreds of automated spam comments there from presumably compromised accounts. The new OP is much more clear regarding what has happened.
https://www.aquasec.com/blog/trivy-supply-chain-attack-what-...
How do you simultaneously revoke all credentials of all your accounts spanning multiple services/machines/users?
