Overview
A threat actor used the open source security tool to deploy an infostealer into CI/CD workflows and steal cloud credentials, SSH keys, tokens, and other sensitive secrets.
Organisations Involved
The following organisations are mentioned in relation to this incident: Trivy Supply Chain Attack Targets.
Multi-Source Coverage
This event has been reported across multiple outlets:
- Trivy Supply Chain Attack Targets CI/CD Secrets — darkreading
Sources: darkreading. Aggregated by Cybernews Agency pipeline.