Are the spam comments all from compromised accounts, presumably compromised due to this hack?
I only clicked on a handful of accounts but several of them have plausibly real looking profiles.
bakugo•1h ago
Some of them were likely already compromised before these incidents, here's one of the accounts near the top making malicious commits to its own repository before the first hack:
"Briefly" is doing a lot of work there. Pre-deploy scans are useless once a bad mutation is actually live. If you don't have a way to auto-revert the infrastructure state instantly, you're just watching the fire spread.
brightball•6m ago
Seriously. All credentials compromised that it can see. It's active in CI/CD pipelines and follow on attacks are happening.
RS-232•43m ago
Pretty ironic that the security tool is insecure
Shank•19m ago
This attack seems predicated on a prior security incident (https://socket.dev/blog/unauthorized-ai-agent-execution-code...) at Trivy where they failed to successfully remediate and contain the damage. I think at this time, Trivy should’ve undertaken a full reassessment of risks and clearly isolated credentials and reduced risk systemically. This did not happen, and the second compromise occurred.
snailmailman•2h ago
I only clicked on a handful of accounts but several of them have plausibly real looking profiles.
bakugo•1h ago
https://github.com/Hancie123/mero_hostel_backend/commit/4bcb...
wswin•19m ago