Checkmarx Falls Victim to Credential Harvesting Attack

Checkmarx disclosed a Trivy supply-chain attack that enabled attackers to harvest credentials and access its GitHub repositories, resulting in malicious code commits, data exfiltration over multiple weeks, a second wave of malicious artifacts, and the subsequent publication of stolen data by the LAPSUS$ group; Checkmarx says customer production environments were not stored in the affected GitHub repositories and remediation is ongoing.