Trusted Design

Widespread GitHub Actions Tag Compromise Exposes CI/CD Secrets

概要

A new supply chain attack targeting Trivy has compromised 75 out of 76 version tags in the aquasecurity/trivy-action GitHub repository. The attacker force-pushed these tags to serve malicious payloads, effectively turning trusted version references into a distribution mechanism for an infostealer. The malicious code executes within GitHub Actions runners, targeting sensitive data in CI/CD environments. It harvests secrets from runner process memory and the filesystem, encrypts the collected data, and exfiltrates it to an attacker-controlled endpoint or a fallback GitHub-based channel. The attack's scope is significant, potentially affecting over 10,000 workflow files on GitHub referencing this action.

Created: 2026-03-20

Indicators

• URL - https://scan.aquasecurtiy.org -
• FileHash-SHA256 - 18a24f83e807479438dcab7a1804c51a00dafc1d526698a66e0640d1e5dd671a -
• hostname - scan.aquasecurtiy.org -
• FileHash-SHA1 - 57a97c7e7821a5776cebc9bb87c984fa69cba8f1 -

類似Pulses

類似するPulseは見つかりませんでした。

このPulseに関連する脅威アクター (事実ベース)

このPulseに関連する脅威アクター (推論ベース)

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクター グラフ

---

← Pulse一覧に戻る