CrowdStrike Discloses GitHub Actions Supply Chain Attack

CrowdStrike disclosed a supply chain attack on Aqua Security's open-source container vulnerability scanner Trivy's GitHub Action (trivy-action). Attackers hijacked maintainer accounts, injected malicious code into the repository, and stole GitHub tokens, registry credentials, and SSH private keys during workflow execution, exfiltrating data to attacker-controlled servers.

The attack exploited trust in open-source software supply chains, turning a security tool into a data theft tool, emphasizing the security risks of high-privilege Actions components in CI/CD pipelines.