Widely used Trivy scanner compromised in ongoing supply-chain attack

A significant security breach has affected Aqua Security's Trivy vulnerability scanner, impacting nearly all versions in a supply chain attack that poses serious risks for developers and their organizations. The incident was confirmed by Itay Shakury, a maintainer of Trivy, following a series of discussions on the matter that were later deleted by the attackers. The attack unfolded in the early hours of Thursday, during which hackers exploited stolen credentials to execute a forced push. This action resulted in the alteration of nearly all trivy-action tags and seven setup-trivy tags, replacing them with malicious dependencies. A forced push circumvents the standard safeguards in Git, allowing for the overwriting of existing commits, which creates an avenue for potential exploitation. Trivy is instrumental for developers, being utilized to identify vulnerabilities and detect hardcoded authentication secrets throughout software development pipelines. With over 33,200 stars on GitHub, its popularity underscores its critical role in modern software development. In a warning to users, Shakury advised that if there’s a chance of using a compromised version, all pipeline secrets should be considered at risk and should be rotated immediately. Security firms Socket and Wiz reported that the malware linked to 75 compromised trivy-action tags is designed to thoroughly search development environments for sensitive information such as GitHub tokens, cloud credentials, SSH keys, and Kubernetes tokens. Once these secrets are detected, the malware encrypts the data before sending it to servers controlled by the attackers. Consequently, any CI/CD pipeline that utilizes software referencing the compromised version tags will execute malicious code when a Trivy scan is performed. The spoofed version tags notably include widely used releases like @0.34.2, @0.33, and @0.18.0, with only version @0.35.0 remaining unaffected.