This attack seems predicated on a prior security incident (<a href="https://socket.dev/blog/unauthorized-ai-agent-execution-code-published-to-openvsx-in-aqua-trivy-vs-code-extension" rel="nofollow">https://socket.dev/blog/unauthorized-ai-agent-execution-code...</a>) at Trivy where they failed to successfully remediate and contain the damage. I think at this time, Trivy should’ve undertaken a full reassessment of risks and clearly isolated credentials and reduced risk systemically. This did not happen, and the second compromise occurred.
I don’t think “briefly compromised” is accurate. The short span between this and the previous compromise of trivy suggests that the attacker was able to persist between their two periods of activity.
Don't forget to pin your GitHub Actions to SHAs instead of tags, that may or may not be immutable!
Frustratingly, hash pinning isn’t good enough here: that makes the action immutable, but the action itself can still make mutable decisions (like pulling the “latest” version of a binary from somewhere on the internet). That’s what trivy’s official action appears to do.<p>(IOW You definitely should still hash-pin actions, but doing so isn’t sufficient in all circumstances.)
That's true. This specific attack was mitigated by hash pinning, but some actions like <a href="https://github.com/1Password/load-secrets-action" rel="nofollow">https://github.com/1Password/load-secrets-action</a> default to using the latest version of an underlying dependency.
I'm pretty sure the trivy action does not do that.
The irony of your vulnerability scanner being the vulnerability.
Are the spam comments all from compromised accounts, presumably compromised due to this hack?<p>I only clicked on a handful of accounts but several of them have plausibly real looking profiles.
Some of them were likely already compromised before these incidents, here's one of the accounts near the top making malicious commits to its own repository before the first hack:<p><a href="https://github.com/Hancie123/mero_hostel_backend/commit/4bcb683829ed40cd388814391c80bf6f2229c7d4" rel="nofollow">https://github.com/Hancie123/mero_hostel_backend/commit/4bcb...</a>
what comments?
Ah, I think the HN post was merged.
My original comment was in response to this related github discussion:
<a href="https://github.com/aquasecurity/trivy/discussions/10420" rel="nofollow">https://github.com/aquasecurity/trivy/discussions/10420</a><p>There are hundreds of automated spam comments there from presumably compromised accounts. The new OP is much more clear regarding what has happened.
Pretty ironic that the security tool is insecure
Briefly?<p><i>"Trivy Supply Chain Attack Spreads, Triggers Self-Spreading CanisterWorm Across 47 npm Packages"</i><p><a href="https://it.slashdot.org/story/26/03/22/0039257/trivy-supply-chain-attack-spreads-triggers-self-spreading-canisterworm-across-47-npm-packages" rel="nofollow">https://it.slashdot.org/story/26/03/22/0039257/trivy-supply-...</a>
"Briefly" is doing a lot of work there. Pre-deploy scans are useless once a bad mutation is actually live. If you don't have a way to auto-revert the infrastructure state instantly, you're just watching the fire spread.
Seriously. All credentials compromised that it can see. It's active in CI/CD pipelines and follow on attacks are happening.
[dead]