News Summary

Aqua Security’s widely used Trivy vulnerability scanner has been compromised in a supply chain attack, impacting numerous developers and organizations. Hackers used stolen credentials to push malicious dependencies into various Trivy tags, affecting versions such as @0.34.2, @0.33, and @0.18.0. The malware embedded in these compromised versions is designed to collect and exfiltrate sensitive information like GitHub tokens, cloud credentials, and SSH keys from developer pipelines. Security firms Socket and Wiz have highlighted the potential for severe security breaches, urging affected users to rotate their credentials immediately. This incident underscores the critical importance of auditing GitHub Action references and maintaining vigilant security practices in software development pipelines.