Sagittarius 1805By Schwarwel
Sr. Security Specialist at iteratec // @seemoo alumni // Member of CCC // Crypto means cryptography.
tfr.
| Blog | https://blog.maass.xyz |
| GitHub | https://github.com/malexmave |
| Pixelfed | https://pixel.infosec.exchange/@hacksilon |
| Pronouns | he/him |
Max Maass 
- 471 Followers
- 130 Following
- 1.5K Posts
SocketTeamPCP has partnered with ransomware group Vect after exfiltrating ~300GB of credentials from CI/CD environments, targeting open source supply chains.
“We will chain these compromises into devastating follow-on ransomware campaigns.”
Details → https://socket.dev/blog/teampcp-partners-with-vect-targeting-oss-supply-chains
RE: https://fosstodon.org/@homeassistant/116295601825508570
Me: „oh, I wonder if they got the cryptography right. Might take a look.“
Blog: „…audited by @trailofbits...“
Me: „alright, nevermind, it’s going to be good, no need to check.“
I never understood the concept of Moltbook - why create a social network for AIs to talk to each other when there's already LinkedIn?
RE: https://fosstodon.org/@SocketSecurity/116285042551834755
Socket has been consistently providing helpful writeups of the recent supply chain attacks. Very good signal to noise ratio, and worth following if you are struggling with figuring out the effects of the latest supply chain incidents.
🚨 TeamPCP is systematically targeting security tools across the #OSS ecosystem, turning scanners and CI pipelines into infostealers. Attacks spreading fast across GitHub Actions, Open VSX, and PyPI.
“These companies were built to protect your supply chains yet they can't even protect their own, the state of modern security research is a joke, as a result we're gonna be around for a long time stealing terrabytes of trade secrets with our new partners.”
Details → https://socket.dev/blog/teampcp-targeting-security-tools-across-oss-ecosystem
Alexandre DulaunoyBefore submitting one or more talks to @passthesaltcon 2026, I wrote a blog post based on my 2024 presentation: Bring Back RSS for Operational Security.
#rss #infosec #cybersecurity #cti #threatintel #osint #opensource #atom
#Trivy got compromised on thursday and released a backdoored new version, which was rolled back. We spent the entire friday in incident response mode. Now they got compromised again over the weekend.
I have a lot of sympathy for people under pressure during an incident, but for fucks sake, having a security tool get compromised three times within two months is just completely bonkers. We spent more time remediating security issues caused by our security tooling than any other cause. And the fact that there wasn't any official communication on friday means that we had to rely on third-party writeups, which were missing critical information like exact docker container digests and time ranges of the compromise. This made incident response completely miserable.
Anyway. Trivy 0.69.4, 0.69.5, 0.69.6 were all compromised with infostealer malware. Do what you have to do. There are several decent writeups:
- https://www.stepsecurity.io/blog/trivy-compromised-a-second-time---malicious-v0-69-4-release
- https://www.wiz.io/blog/trivy-compromised-teampcp-supply-chain-attack
- https://labs.boostsecurity.io/articles/20-days-later-trivy-compromise-act-ii/
And Trivy has an advisory on their GitHub that covers last thursday, but not the second compromise over the weekend: https://github.com/aquasecurity/trivy/security/advisories/GHSA-69fq-xp46-6x23
Trivy Compromised a Second Time - Malicious v0.69.4 Release, aquasecurity/setup-trivy, aquasecurity/trivy-action GitHub Actions Compromised - StepSecurity
On March 19, 2026, trivy — a widely used open source vulnerability scanner maintained by Aqua Security — experienced a second security incident. Three weeks after the hackerbot-claw incident on February 28 that resulted in a repository takeover, a new compromised release (v0.69.4) was published to the trivy repository. The original incident disclosure discussion (#10265) was also deleted during this period, and version tags on the aquasecurity/setup-trivy GitHub Action were removed. Trivy maintainers deleted the v0.69.4 tag and Homebrew downgraded to v0.69.3. The following is a factual account of what we observed through public GitHub data.
scy
Eric Alper