Storyline
March 2025 supply chain attacks compromise open source tools and IoT devices
In March 2025, multiple supply chain attacks targeted prominent open source application security organizations and IoT devices. Three organizations—Xygeni, Aqua/Trivy, and Checkmarkx—were compromised via GitHub Actions.
Current brief openSource links open
This current storyline is open here with summary, metadata, source links, continuity context, and full evidence. Paid is for compare-over-time, alerts, exports, and workflow.
No card needed for the free brief.
Evidence trail (top sources)
top sources (1 domains)domains are deduped. counts indicate coverage, not truth.1 top source shown
limited source diversity in top sources
Overview
In March 2025, multiple supply chain attacks targeted prominent open source application security organizations and IoT devices. Three organizations—Xygeni, Aqua/Trivy, and Checkmarkx—were compromised via GitHub Actions.
Score total
1.23
Momentum 24h
2
Posts
2
Origins
2
Source types
2
Duplicate ratio
0%
Why now
- Recent March 2025 incidents show increasing sophistication and scale of supply chain compromises.
- The full impact of these attacks is still unfolding, highlighting the urgency for improved supply chain security.
- These events underscore the need for continuous monitoring of both software and hardware supply chains.
Why it matters
- Supply chain attacks can compromise widely used open source tools and IoT devices, impacting thousands of organizations.
- Reused authentication secrets reveal operational security weaknesses exploitable across multiple targets.
- Understanding these attacks helps organizations improve defenses and adopt measures like SBOMs to mitigate future risks.
Continuity snapshot
- Trend status: insufficient_history.
- Continuity stage: emerging_confirmed.
- Current status: open.
- 2 current source-linked posts are attached to this storyline.
All evidence
All evidence
The Register Security
go.theregister.com
blueteamsec on Reddit (via Reddit)
blueteamsec on Reddit (via Reddit)
Show filters & breakdown
Posts loaded: 0Publishers: 2Origin domains: -Duplicates: -
Showing 2 / 0
Top publishers (this list)
- go.theregister.com (1)
- blueteamsec on Reddit (via Reddit) (1)
Top origin domains (this list)
- Unknown (2)