‘If you suspect you were running a compromised version, treat all pipeline secrets as compromised and rotate immediately,’ Trivy maintainer says.

CSO Online offers insights into cybersecurity, risk management, and IT leadership, providing articles, reports, and expert analysis to help security professionals navigate the evolving threat landscape and protect their organizations from cyber attacks. By exploring CSO Online's curated content, CISOs, security managers, and IT executives can learn about threat intelligence, security frameworks, and incident response strategies for building resilient cybersecurity programs. Whether you're defending against ransomware, phishing attacks, or insider threats, CSO Online offers resources to strengthen your security posture and safeguard your digital assets.

CSO Online

The open-source Trivy vulnerability scanner was backdoored in a supply chain attack that injected credential-stealing malware into official releases and GitHub Actions. Attackers compromised three components — trivy-action, setup-trivy, and the Trivy binary itself — overwriting 75 of 76 version tags with malicious code. The malware steals SSH keys, cloud credentials, Kubernetes tokens, and other secrets from CI/CD runners, exfiltrating them to attacker-controlled infrastructure. The attack exploited a misconfigured GitHub Actions workflow and used force-pushed tag manipulation to avoid detection, cloning original commit metadata to disguise malicious commits. Organizations are advised to rotate all pipeline secrets immediately, pin actions to full commit SHA hashes, and upgrade to safe versions (Trivy v0.69.3, trivy-action 0.35.0, setup-trivy 0.2.6).

Trivy vulnerability scanner backdoored with credential stealer in supply chain attack