IT Brew // Morning Brew // Update

CYBERSECURITY

Peach_istock/Getty Images

Open-source security scanners are the latest targets for supply-chain attack actors.

Aqua Security, the company that maintains Trivy, an open-source vulnerability scanner, was reportedly targeted by a hacker group known as TeamPCP on March 19. The threat actors injected credential-stealing malware into Trivy through GitHub Actions and container images, cloud security company Wiz shared in a post.

Cory Michal, VP of security at SaaS company AppOmni, told IT Brew that, because Trivy is commonly used in software-development pipelines to check for vulnerabilities before pushing to production, attackers can access and steal code at a sensitive point in the development process.

“This [malware] got pushed to thousands of organizations, a lot of open-source projects, things like that,” Michal said. “What happened is, when that code ran in their build pipeline, it stole all those credentials. Now the attacker is going through and leveraging those credentials.”

What developers need to do next.—CN

☕️ Supply-chain attack hits open-source packages