4 ms·

Aquasecurity/Trivy GitHub Repository and Homebrew Cask Compromised (again)

• mmsc 7mo ago
  The offending commit seems to be: https://github.com/aquasecurity/trivy/commit/1885610c6a34811c8296416ae69f568002ef11ec https://github.com/aquasecurity/trivy/commit/1885610c6a34811... which updates the action to `actions/checkout@70379aad1a8b40919ce8b382d3cd7d0315cde1d0 # v6.0.2`. https://github.com/actions/checkout/commit/70379aad1a8b40919ce8b382d3cd7d0315cde1d0 https://github.com/actions/checkout/commit/70379aad1a8b40919... is not actually in `actions/checkout` but a fork, and it pulls malicious code from the typo-squatted "scan.aquasecurtiy.org" (note the _tiy_). Any system with Trivy 0.69.4 on it (and being run) can be assumed to be compromised.
  • deleted 7mo ago
    [deleted]
• man8alexd 7mo ago
  More details here: https://www.stepsecurity.io/blog/trivy-compromised-a-second-time---malicious-v0-69-4-release https://www.stepsecurity.io/blog/trivy-compromised-a-second-... Current GitHub discussion (the old discussion was removed by the attacker): https://github.com/aquasecurity/trivy/discussions/10420 https://github.com/aquasecurity/trivy/discussions/10420
• jl6 7mo ago
  Any recommendations for Trivy alternatives to use while Aqua rebuilds their reputation?
  • man8alexd 7mo ago
    Grype, Clair
• Heckinator 7mo ago
  [dead]