CI/CD
4 articles with this tag
Trivy Supply-Chain Compromise (March 2026): What to Do If You Run Trivy in CI
On March 19, 2026, a malicious v0.69.4 of Trivy, the open-source vulnerability scanner developed by Aqua Security, was released, and the GitHub Actions trivy-action (76 of 77 tags) and setup-trivy (all 7 tags) were repointed to malicious commits. According to Aqua, the malicious code collected secrets from CI runners and sent them out; the cause was credentials taken in a compromise that began in late February, which the attacker could keep using because the March 1 rotation was not done all at once. This site's take: the lesson is not only to pin actions by commit ID (SHA) instead of by tag. An action pinned by SHA can still call another component by tag, which lets a malicious version in. Leaked credentials must be replaced all at once, or the attacker can keep using them. Run scanners in jobs that hold no deployment secrets.
osv-scanner in Practice — pnpm, Ignoring CVEs, Offline Mode, and the Errors You Hit
Only the second-day questions, answered against the official docs. pnpm-lock.yaml is supported; ignores live in osv-scanner.toml under IgnoredVulns and can carry an expiry; offline mode is three flags with three different jobs. This site's view: a scanner reports known vulnerabilities, and says nothing about a version you pinned yourself going stale — that needs a separate mechanism.
npm Supply-Chain Worms: How Credentials Are Stolen at Install Time, and How to Defend
Adding a dependency means running someone else's code with your privileges, so the defense belongs at install time. This site's view: signatures and provenance did not stop this campaign, so they cannot be the basis of trust. What works is disabling install scripts by default, letting dependencies age a few days before adopting them, and keeping tokens short-lived and narrowly scoped. And if you suspect infection, the order in which you revoke matters.
Codecov breach (2021) — when a CI tool was tampered with and secrets leaked
A trusted CI tool (the curl|bash Bash Uploader) was altered upstream. Because your own code was untouched, it went unnoticed for ~2 months while CI secrets leaked; a checksum check caught it. In your CI: verify fetched artifacts, least-privilege secrets, rotation, egress monitoring.