Posts (page 2)
Shai-Hulud is back: an npm worm loots the AntV ecosystem
Shai-Hulud is back. This self-replicating npm worm hit Alibaba's AntV ecosystem on 19 May 2026: it reads GitHub Actions runner memory, steals 130 types of secrets and plants backdoors in Claude Code. I checked my own package-lock.json, here is what I found and what to do.
Read the article
GitHub Actions 2026: what the new security roadmap really changes
GitHub has published its 2026 security roadmap for Actions. Dependency locking, policies, scoped secrets, Actions Data Stream and an egress firewall answer a reality made visible by Trivy, Checkmarx/KICS and Bitwarden CLI: CI/CD is now a critical attack surface.
Read the article
Checkmarx/KICS compromised: when security scanners become the attack surface
After Trivy, the Checkmarx/KICS incident makes the message brutal: we are no longer talking about a tool that contains a flaw, but about a security scanner that teams deliberately run inside their pipelines, over their repositories, over their Terraform and Kubernetes files, with sensitive variables within reach. I detail the affected artefacts, the troubling parallel with Trivy, the downstream spread all the way to the Bitwarden CLI, the trap of mutable Docker tags, and the real issue everyone avoids: what a scanner gets to see of your infrastructure.
Read the article
Argo CD + Kyverno: the GitOps policy as code your cluster was missing
You drive your Kubernetes deployments with Argo CD in GitOps mode, but who checks that whatever lands in the cluster follows your security rules? I break down the pattern published by the CNCF that pairs Argo CD with Kyverno to turn your policies into versioned code, deployed and enforced automatically. I cover the App-of-Apps pattern, why you should run in audit mode before enforce, and why admission control is the last line of defence in your software supply chain.
Read the article
The Trivy affair, Act IV, Aqua finally spoke and here is what it changes
In my previous post I wrote that without a complete and transparent analysis of the incident, I could not recommend Trivy in good conscience. Aqua Security eventually published that analysis, updated five times between 22 March and 1 April 2026, with support from the forensic firm Sygnia. The document is dense and technically rich, but it deserves a critical reading. I detail what it genuinely reveals about tag poisoning, the three stage payload and the blockchain based persistence, what it leaves unsaid, and how it changes my recommendations.
Read the article
Trivy compromised, Chainguard offers 12 free months and a supply chain lesson
In March 2026 the Trivy ecosystem suffered a major compromise: a malicious release, the setup-trivy action tampered with, tags rewritten, then the incident spreading to Docker Hub images. It is a brutal reminder that a project can keep a clean source repository while shipping dangerous artefacts through a compromised release chain. Chainguard announced 12 free months of Trivy images in that context. Beyond the commercial offer, I focus on the underlying lesson: what an independent build chain really changes about the blast radius of a poisoned release.
Read the article
KICS and LiteLLM compromised: two supply chain attacks that confirm a change of scale
Barely enough time to analyse the Trivy compromise before a new wave hit other widely used building blocks: the KICS/Checkmarx GitHub Action and the LiteLLM packages on PyPI. These two incidents are not isolated accidents. They show a campaign shifting ground, reusing the same mechanisms and always chasing the same prize: your secrets, tokens, runners and clusters. I analyse both vectors, what suggests they are connected, the defensive gaps they expose, and what needs to change for good beyond the emergency response.
Read the article
Trivy compromised a second time with a poisoned v0.69.4 release
Three weeks after the initial attack, Trivy suffered a second incident: the v0.69.4 release published on 19 March 2026 was poisoned. This second episode is worse than the first, because the malicious artefact was crafted to look perfectly legitimate and spread through Homebrew, container registries and the official GitHub Action. I reconstruct the timeline, the likely starting point with a stolen access token that was never revoked, the role of a typosquatted domain, and the Docker Hub twist that followed.
Read the article
GitHub Actions: 15 security pitfalls that expose your pipelines
In 2025, attacks like Shai Hulud v2, GhostAction and tj-actions/changed-files compromised tens of thousands of repositories through GitHub Actions. The cause? Always the same mistakes: mutable tags, overly broad permissions, command injection, misused pull_request_target. This article reviews 15 exploited pitfalls, the still immature tooling ecosystem, and gives you the fixes to harden your pipelines.
Read the article
Trivy wiped out after a supply chain attack by an AI bot
This Sunday, while installing Trivy through mise, I hit a 404 error. The aquasecurity/trivy GitHub repository was empty. What I took for a bug turned out to be a supply chain attack: an autonomous AI bot compromised a PAT, deleted every release, renamed the repository and published a malicious VS Code extension. Full timeline and lessons.
Read the article