News for hackers. Stuff that matters.

A comment on Over 100k Infected Repos Found on GitHub. Parent comment

Re:Over 100k Infected Repos Found on GitHub by alentred on Thursday February 29, 2024 @04:34AM (#39547831)
You may look into Trivy [0] , works very well for me so far.

[0] https://trivy.dev/

[ Parent | on HN ]
Re:Over 100k Infected Repos Found on GitHub by prmoustache on Thursday February 29, 2024 @06:56AM (#39548236)
Trivy only do a CVE / package version mapping. It will not tell you you are using a malicious package from an unknown repo because of typosquatting or bad practices.
[ Parent | on HN ]
Re:Over 100k Infected Repos Found on GitHub by richbell on Thursday February 29, 2024 @05:22AM (#39547950)
As far as I know, Trivy only flags known vulnerabilities and would not protect against supply-chain attacks like this.
[ Parent | on HN ]