Trivy supply-chain breach reportedly pushed an infostealer via GitHub Actions
BleepingComputer reports that the popular Trivy vulnerability scanner was compromised in a supply-chain attack, distributing credential-stealing malware through official releases and GitHub Actions. The incident is a reminder that CI/CD pipelines and release automation are prime targets.
The maintainers and ecosystem around Trivy, a widely used vulnerability scanner, are reportedly responding to a supply-chain compromise in which attackers distributed credential-stealing malware via official releases and GitHub Actions.
Why it matters
- Security tooling runs with broad access in CI/CD: source code, build artifacts, container registries, cloud credentials, and tokens.
- A compromise can cascade across many downstream organizations that consume releases or reuse workflows.
What defenders should do now
- Identify exposure: check whether Trivy binaries, container images, or GitHub Actions workflows were used during the affected window.
- Rotate secrets: update GitHub tokens, cloud keys, registry credentials, and any secrets accessible to CI runners.
- Pin and verify: prefer pinned action SHAs, verify release signatures/checksums when available, and use provenance (e.g., SLSA-style attestations) where supported.
- Reduce privileges: scope CI permissions tightly, separate build and deploy credentials, and use short-lived tokens.
Operational lesson
DevSecOps controls must treat the build pipeline as production-critical infrastructure: continuous monitoring, least privilege, and fast secret rotation are essential to contain supply-chain blast radius.
Source: BleepingComputer