A popular open-source vulnerability scanner (Trivy) was compromised last week in a supply chain attack

[campuscodi@mastodon.social]

A popular open-source vulnerability scanner (Trivy) was compromised last week in a supply chain attack

https://www.aquasec.com/blog/autonomous-runtime-security-turning-runtime-intelligence-into-agentic-response-2/

https://www.aikido.dev/blog/teampcp-deploys-worm-npm-trivy-compromise

https://github.com/aquasecurity/trivy/discussions/10425

https://socket.dev/blog/trivy-under-attack-again-github-actions-compromise

https://www.stepsecurity.io/blog/trivy-compromised-a-second-time---malicious-v0-69-4-release

https://www.wiz.io/blog/trivy-compromised-teampcp-supply-chain-attack

https://www.crowdstrike.com/en-us/blog/from-scanner-to-stealer-inside-the-trivy-action-supply-chain-compromise/

[bontchev@infosec.exchange]

@campuscodi The vulnerability scanner was vulnerable. Doctor, heal thyself.