Trivy

The article explores the 'distroless security gap' where minimizing container size inadvertently breaks vulnerability scanning by removing package metadata. It proposes a shift toward bottom-up, declarative container assembly to achieve both minimal attack surfaces and full security auditability.

The article advocates for a proactive 'sniff test' methodology to validate the integrity of SBOMs in containerized environments. It highlights how identifying omissions like unpinned packages or missing dependencies is crucial for preventing supply chain attacks.

The TeamPCP hacker group has compromised the Checkmarx Jenkins AST plugin by leveraging credentials stolen from a previous Trivy scanner breach. This supply-chain attack allows for the delivery of credential-stealing malware to developer environments.