Trivy (a very widely-used security scanner) was recently compromised. Anyone who installed the aquasecurity/trivy-action dependency by tag rather than by sha during a 3 hour period on March 19 was likely compromised. There is a Github security advisory at https://github.com/aquasecurity/trivy/security/advisories/GH...
6 separate people have tried to submit this to HN. All of the submissions are marked as [dead]. I am unsure whether this is a malicious action taken by the actors who compromised trivy or whether it's just the result of prior spam under github.com/aquasecurity, but regardless it is probably not ideal for security advisories to be auto-marked as [dead].
7 comments
[ 71.8 ms ] story [ 51.0 ms ] thread6 separate people have tried to submit this to HN. All of the submissions are marked as [dead]. I am unsure whether this is a malicious action taken by the actors who compromised trivy or whether it's just the result of prior spam under github.com/aquasecurity, but regardless it is probably not ideal for security advisories to be auto-marked as [dead].
Big security stories often get republished, one might say reviewed and filtered. For this story I see
opensourcemalware.com - https://news.ycombinator.com/item?id=47449498
stepsecurity.io - https://news.ycombinator.com/item?id=47451081
arstechnica.com - https://news.ycombinator.com/item?id=47464996
and 4 others.
Or: write a short blog post about it, and post that, on your (different) domain.