The entire Trivy GitHub repository was emptied — all source code, history, releases, and assets were deleted or replaced with an empty repository.

What actually was compromised

The popular open-source tool Trivy (a vulnerability scanner maintained by Aqua Security) was fully compromised on GitHub as part of a wider attack impacting several high-profile repositories. During the incident:

The entire Trivy GitHub repository was emptied — all source code, history, releases, and assets were deleted or replaced with an empty repository.

Releases and binaries were temporarily unavailable, breaking CI/CD pipelines and automation that pull Trivy assets.

 How the compromise occurred
The root cause wasn’t traditional malware or a leak in Trivy itself — it was a supply-chain compromise involving GitHub Actions workflows:
1. Automated AI bot exploited misconfigured CI/CD workflows
Security researchers observed an autonomous AI agent scanning public repositories for poorly secured GitHub Actions workflows.
This bot targeted repositories with workflows that could be abused without adequate review or safeguards.
It used techniques like hiding malicious payloads in unusual places (branch names, file names, etc.) that triggered automated workflows.
2. Remote code execution via GitHub Actions
Once the malicious PR branch triggered a workflow, the runner executed code chosen by the bot. In the worst-case scenario like Trivy:
The bot was able to achieve remote code execution in a GitHub Actions runner.
That allowed it to exfiltrate a GitHub Personal Access Token (PAT) with write rights.
3. Use of stolen token to destroy/modify the repo
With the stolen PAT:
The attacker deleted all 178 Trivy release tags and associated assets.
The attacker replaced the public repository with an empty one (effectively removing the codebase).
In simpler terms:
a misconfigured CI/CD workflow allowed an automated agent to trick GitHub Actions into running rogue steps, leading to a leaked credential, and that credential was then used to delete and rewrite the Trivy repo.

Solution 1:
Lock Down GITHUB_TOKEN Permissions (Least Privilege)
By default, GITHUB_TOKEN may have more permissions than needed.
✅ Best Practice
Explicitly define minimal permissions in every workflow:
permissions:
 contents: read
 pull-requests: read

Only grant write if absolutely required:

permissions:
contents: write
packages: write

Solution 2: Never Run Untrusted Code with Write Tokens
The most dangerous pattern:
on: pull_request

This runs code from forks.
If that job has:
contents: write
access to secrets
release permissions You are exposed.