A security incident involving Trivy (v0.69.4) has been reported, with indications that the release may have included malicious code capable of accessing credentials in GitHub Secrets. Related GitHub Actions (trivy-action and trivy-setup) are also believed to be affected. In response, ASF Infrastructure and Security teams have: -- Disabled previously allowed “verified creator” GitHub Actions -- Initiated an investigation into potential exposure of secrets and repositories -- Noted that some builds may fail due to these precautionary measures Projects using affected workflows may need to request approvals for required actions. More details: https://buff.ly/1IjyOlz #opensource
Joe Schaefer
1mo
UGH
Link to blog post (it changed): https://www.stepsecurity.io/blog/trivy-compromised-a-second-time---malicious-v0-69-4-release