On Sat, 21 Mar 2026 at 20:40, Alan Coopersmith <[email protected]> wrote: > > https://socket.dev/blog/trivy-under-attack-again-github-actions-compromise > reports that a compromised credential with write access to the repository > was used to modify 75 out of 76 version tags in the aquasecurity/trivy-action > repository, the official GitHub Action for running Trivy vulnerability scans > in > CI/CD pipelines.
Of note, this attack is still on-going and the extent of Trivy's compromise seems to be growing. After the above was announced, further malicious actions were taken by the third party targeting them. https://socket.dev/blog/trivy-docker-images-compromised details how additional compromised Trivy artifacts (image tags `0.69.5` and `0.69.6`) were published to Docker Hub on March 22 without corresponding GitHub releases or tags. Trivy published a GitHub Security Advisory and has since updated it with the new Docker Hub compromise information: https://github.com/aquasecurity/trivy/security/advisories/GHSA-69fq-xp46-6x23 Cheers, Jeremy
