Consider including GitHub malware advisories to detect compromises like Shai-Hulud

[F30]

Description

Trivy currently does not report issues for (NPM) packages compromised with malware, such as those from the recent Shai-Hulud campaigns.

That is probably because while GitHub Security Advisories have been issued for the versions removed from NPM, these are special Malware advisories. You only find them through the search by adding the type:malware to your query. Likewise, the API only returns them when explicitly requesting "type": "malware".

Refer to my blog post for more details: Why Scanners Fail in Practice: Lessons from the Shai-Hulud Attacks on NPM

I would have expected Trivy to identify the compromised versions when scanning anything including NPM dependencies (filesystem, SBOM, etc.).

Some might argue that malware infections should not be part of vulnerability scam, since they are not exploitable vulnerabilities, but rather instances where the compromise has already occurred in the supply chain. But ultimately, these dependencies are blatantly insecure. If anything, the risk is higher than that of a vulnerable, but unexploited package.

I'm aware that Aqua does offer malware detection as part of its commercial offering, even though I couldn't find any details on its capabilities. But this is not about advanced detection of unknown malware. It is just about including the full information that is already available from advisories.

Target

SBOM

Scanner

Vulnerability