A popular open-source vulnerability scanner (Trivy) was compromised last week in a supply chain attack
www.aquasec.com/blog/autonom...
www.aikido.dev/blog/teampcp...
github.com/aquasecurity...
socket.dev/blog/trivy-u...
www.stepsecurity.io/blog/trivy-c...
www.wiz.io/blog/trivy-c...
www.aquasec.com/blog/autonom...
www.aikido.dev/blog/teampcp...
github.com/aquasecurity...
socket.dev/blog/trivy-u...
www.stepsecurity.io/blog/trivy-c...
www.wiz.io/blog/trivy-c...
TeamPCP deploys CanisterWorm on NPM following Trivy compromise
TeamPCP deploys CanisterWorm on NPM following Trivy compromise
www.aikido.dev
March 22, 2026 at 10:45 AM
A popular open-source vulnerability scanner (Trivy) was compromised last week in a supply chain attack
www.aquasec.com/blog/autonom...
www.aikido.dev/blog/teampcp...
github.com/aquasecurity...
socket.dev/blog/trivy-u...
www.stepsecurity.io/blog/trivy-c...
www.wiz.io/blog/trivy-c...
www.aquasec.com/blog/autonom...
www.aikido.dev/blog/teampcp...
github.com/aquasecurity...
socket.dev/blog/trivy-u...
www.stepsecurity.io/blog/trivy-c...
www.wiz.io/blog/trivy-c...
medium.com/@nehaspatil/...
Security as a post-release checklist doesn't work anymore. Modern pipelines need to catch vulnerabilities before code reaches production, not after. DevSecOps means embedding security scans into every build automatically. (1️⃣/3️⃣)
🧵
Security as a post-release checklist doesn't work anymore. Modern pipelines need to catch vulnerabilities before code reaches production, not after. DevSecOps means embedding security scans into every build automatically. (1️⃣/3️⃣)
🧵
Building a Secure CI/CD Pipeline with OWASP, SonarQube & Trivy
Gone are the days when security was a post-release checklist item.
In modern DevOps, speed without security is a recipe for disaster.
medium.com
November 27, 2025 at 5:00 PM
medium.com/@nehaspatil/...
Security as a post-release checklist doesn't work anymore. Modern pipelines need to catch vulnerabilities before code reaches production, not after. DevSecOps means embedding security scans into every build automatically. (1️⃣/3️⃣)
🧵
Security as a post-release checklist doesn't work anymore. Modern pipelines need to catch vulnerabilities before code reaches production, not after. DevSecOps means embedding security scans into every build automatically. (1️⃣/3️⃣)
🧵
The Trivy Operator leverages Trivy to continuously scan your Kubernetes cluster for security issues
The scans are summarised in security reports as Kubernetes Custom Resource Definitions, which become accessible through the Kubernetes API
➜ https://github.com/aquasecurity/trivy-operator
The scans are summarised in security reports as Kubernetes Custom Resource Definitions, which become accessible through the Kubernetes API
➜ https://github.com/aquasecurity/trivy-operator
January 23, 2025 at 6:06 PM
The Trivy Operator leverages Trivy to continuously scan your Kubernetes cluster for security issues
The scans are summarised in security reports as Kubernetes Custom Resource Definitions, which become accessible through the Kubernetes API
➜ https://github.com/aquasecurity/trivy-operator
The scans are summarised in security reports as Kubernetes Custom Resource Definitions, which become accessible through the Kubernetes API
➜ https://github.com/aquasecurity/trivy-operator
Claude source code leak, Cisco source code stolen after recent Trivy compromise, multiple AWS keys were stolen & later used to perform unauthorized activities across a number of Cisco AWS accounts. On the heels of LiteLLM & Checkmarx supply chain attacks.
www.bleepingcomputer.com/news/securit...
www.bleepingcomputer.com/news/securit...
Cisco source code stolen in Trivy-linked dev environment breach
Cisco has suffered a cyberattack after threat actors used stolen credentials from the recent Trivy supply chain attack to breach its internal development environment and steal source code belonging to...
www.bleepingcomputer.com
April 1, 2026 at 5:47 AM
Claude source code leak, Cisco source code stolen after recent Trivy compromise, multiple AWS keys were stolen & later used to perform unauthorized activities across a number of Cisco AWS accounts. On the heels of LiteLLM & Checkmarx supply chain attacks.
www.bleepingcomputer.com/news/securit...
www.bleepingcomputer.com/news/securit...
August 15, 2023 at 8:16 PM
Si vous avez Trivy 0.69.4 en local ou sur vos CI, il est urgent de lire de quoi il retourne : www.wiz.io/blog/trivy-c...
Trivy Compromised by "TeamPCP" | Wiz Blog
Breaking down the March 2026 Trivy supply chain attack. TeamPCP compromised trivy + trivy-action & setup-trivy GitHub Actions, deploying credential stealers.
www.wiz.io
March 20, 2026 at 10:22 PM
Si vous avez Trivy 0.69.4 en local ou sur vos CI, il est urgent de lire de quoi il retourne : www.wiz.io/blog/trivy-c...
Encore une fois : sécurisez vos putains de supply chain
github.com/aquasecurity...
github.com/aquasecurity...
Trivy security incident 2026-03-01 · aquasecurity trivy · Discussion #10265
Trivy has been attacked today via GitHub Actions, along with other popular projects: https://www.stepsecurity.io/blog/hackerbot-claw-github-actions-exploitation. We believe the vulnerability came f...
github.com
March 2, 2026 at 8:34 AM
Encore une fois : sécurisez vos putains de supply chain
github.com/aquasecurity...
github.com/aquasecurity...
Dan Lorenc is exactly right:
"I blame[] the Trivy breach on GitHub. The design of Actions is plain irresponsible today and ignores a decade of supply chain security work from other ecosystems."
www.linkedin.com/posts/danlor...
"I blame[] the Trivy breach on GitHub. The design of Actions is plain irresponsible today and ignores a decade of supply chain security work from other ecosystems."
www.linkedin.com/posts/danlor...
GitHub Actions Security Flaws: Immutable Tags, Token Access, and More | Dan Lorenc posted on the topic | LinkedIn
Yesterday I blamed the Trivy breach on GitHub. The design of Actions is plain irresponsible today and ignores a decade of supply chain security work from other ecosystems.
Here's what they would have...
www.linkedin.com
April 2, 2026 at 2:29 AM
Dan Lorenc is exactly right:
"I blame[] the Trivy breach on GitHub. The design of Actions is plain irresponsible today and ignores a decade of supply chain security work from other ecosystems."
www.linkedin.com/posts/danlor...
"I blame[] the Trivy breach on GitHub. The design of Actions is plain irresponsible today and ignores a decade of supply chain security work from other ecosystems."
www.linkedin.com/posts/danlor...
🚨 Breaking: Trivy GitHub Actions supply chain attack – 75 out of 76 version tags compromised.
If your CI/CD pipelines reference “aquasecurity/trivy-action” by version tag, you’re likely running malware right now.
Full write-up: socket.dev/blog/trivy-u...
If your CI/CD pipelines reference “aquasecurity/trivy-action” by version tag, you’re likely running malware right now.
Full write-up: socket.dev/blog/trivy-u...
Trivy Under Attack Again: Widespread GitHub Actions Tag Comp...
Attackers compromised Trivy GitHub Actions by force-updating tags to deliver malware, exposing CI/CD secrets across affected pipelines.
socket.dev
March 20, 2026 at 4:16 AM
🚨 Breaking: Trivy GitHub Actions supply chain attack – 75 out of 76 version tags compromised.
If your CI/CD pipelines reference “aquasecurity/trivy-action” by version tag, you’re likely running malware right now.
Full write-up: socket.dev/blog/trivy-u...
If your CI/CD pipelines reference “aquasecurity/trivy-action” by version tag, you’re likely running malware right now.
Full write-up: socket.dev/blog/trivy-u...
The Trivy Operator leverages Trivy to continuously scan your Kubernetes cluster for security issues
The scans are summarised in security reports as Kubernetes Custom Resource Definitions, which become accessible through the Kubernetes API
➤ https://github.com/aquasecurity/trivy-operator
The scans are summarised in security reports as Kubernetes Custom Resource Definitions, which become accessible through the Kubernetes API
➤ https://github.com/aquasecurity/trivy-operator
February 23, 2025 at 6:06 PM
The Trivy Operator leverages Trivy to continuously scan your Kubernetes cluster for security issues
The scans are summarised in security reports as Kubernetes Custom Resource Definitions, which become accessible through the Kubernetes API
➤ https://github.com/aquasecurity/trivy-operator
The scans are summarised in security reports as Kubernetes Custom Resource Definitions, which become accessible through the Kubernetes API
➤ https://github.com/aquasecurity/trivy-operator
Cisco がやられたっぽい。
Cisco source code stolen in Trivy-linked dev environment breach
www.bleepingcomputer.com/news/securit...
Cisco source code stolen in Trivy-linked dev environment breach
www.bleepingcomputer.com/news/securit...
Cisco source code stolen in Trivy-linked dev environment breach
Cisco has suffered a cyberattack after threat actors used stolen credentials from the recent Trivy supply chain attack to breach its internal development environment and steal source code belonging to...
www.bleepingcomputer.com
April 1, 2026 at 12:01 AM
Cisco がやられたっぽい。
Cisco source code stolen in Trivy-linked dev environment breach
www.bleepingcomputer.com/news/securit...
Cisco source code stolen in Trivy-linked dev environment breach
www.bleepingcomputer.com/news/securit...
Trivy 0.52.1 running on age v1.1.1
> Total: 31 (UNKNOWN: 2, LOW: 0, MEDIUM: 13, HIGH: 14, CRITICAL: 2)
govulncheck v1.1.2
> No vulnerabilities found.
govulncheck is correct. All the vulns reported by the other thing are provably false positives.
Please use govulncheck.
> Total: 31 (UNKNOWN: 2, LOW: 0, MEDIUM: 13, HIGH: 14, CRITICAL: 2)
govulncheck v1.1.2
> No vulnerabilities found.
govulncheck is correct. All the vulns reported by the other thing are provably false positives.
Please use govulncheck.
June 16, 2024 at 1:21 PM
Trivy 0.52.1 running on age v1.1.1
> Total: 31 (UNKNOWN: 2, LOW: 0, MEDIUM: 13, HIGH: 14, CRITICAL: 2)
govulncheck v1.1.2
> No vulnerabilities found.
govulncheck is correct. All the vulns reported by the other thing are provably false positives.
Please use govulncheck.
> Total: 31 (UNKNOWN: 2, LOW: 0, MEDIUM: 13, HIGH: 14, CRITICAL: 2)
govulncheck v1.1.2
> No vulnerabilities found.
govulncheck is correct. All the vulns reported by the other thing are provably false positives.
Please use govulncheck.
Automate Trivy container scans with Python. 296 lines, intermediate level, for DevOps folks who want HIGH and CRITICAL CVEs flagged before deploy.
https://www.valtersit.com/python/container-image-security-scanner-trivy/
#Python #DevSecOps #Containers
https://www.valtersit.com/python/container-image-security-scanner-trivy/
#Python #DevSecOps #Containers
Container Image Security Scanner (Trivy)
www.valtersit.com
September 23, 2026 at 9:30 AM
Automate Trivy container scans with Python. 296 lines, intermediate level, for DevOps folks who want HIGH and CRITICAL CVEs flagged before deploy.
https://www.valtersit.com/python/container-image-security-scanner-trivy/
#Python #DevSecOps #Containers
https://www.valtersit.com/python/container-image-security-scanner-trivy/
#Python #DevSecOps #Containers
cryptotokens, etc into three things.
- Trivy
- Trivy GitHub actions
- Trivy Docker stuff
As is tradition, once TeamPCP put malware into Trivy stuff, anyone who did anything with Trivy was given malware. TeamPCP got a metric poop ton of stolen data and began using it to move to NPM
- Trivy
- Trivy GitHub actions
- Trivy Docker stuff
As is tradition, once TeamPCP put malware into Trivy stuff, anyone who did anything with Trivy was given malware. TeamPCP got a metric poop ton of stolen data and began using it to move to NPM
March 25, 2026 at 3:14 PM
cryptotokens, etc into three things.
- Trivy
- Trivy GitHub actions
- Trivy Docker stuff
As is tradition, once TeamPCP put malware into Trivy stuff, anyone who did anything with Trivy was given malware. TeamPCP got a metric poop ton of stolen data and began using it to move to NPM
- Trivy
- Trivy GitHub actions
- Trivy Docker stuff
As is tradition, once TeamPCP put malware into Trivy stuff, anyone who did anything with Trivy was given malware. TeamPCP got a metric poop ton of stolen data and began using it to move to NPM
Trivy Supply Chain Attack Spreads, Triggers Self-Spreading CanisterWorm Across 47 npm Packages
https://it.slashdot.org/story/26/03/22/0039257/trivy-supply-chain-attack-spreads-triggers-self-spreading-canisterworm-across-47-npm-packages?utm_source=rss1.0mainlinkanon&utm_medium=feed
Trivy Supply Chain Attack Spreads, Triggers Self-Spreading CanisterWorm Across 47 npm Packages
"We have removed all malicious artifacts from the affected registries and channels," Trivy maintainer Itay Shakury posted today, noting that all the latest Trivy releases "now point to a safe version." But "On March 19, we observed that a threat actor used a compromised credential..."
And today T...
it.slashdot.org
March 22, 2026 at 12:57 AM
Trivy Supply Chain Attack Spreads, Triggers Self-Spreading CanisterWorm Across 47 npm Packages
https://it.slashdot.org/story/26/03/22/0039257/trivy-supply-chain-attack-spreads-triggers-self-spreading-canisterworm-across-47-npm-packages?utm_source=rss1.0mainlinkanon&utm_medium=feed
The open source vulnerability scanner trivy has experienced a *second* security incident: a compromised release (v0.69.4) was published to the trivy repository.
https://www.stepsecurity.io/blog/trivy-compromised-a-second-time---malicious-v0-69-4-release
https://www.stepsecurity.io/blog/trivy-compromised-a-second-time---malicious-v0-69-4-release
Trivy Compromised a Second Time - Malicious v0.69.4 Release, aquasecurity/setup-trivy, aquasecurity/trivy-action GitHub Actions Compromised - StepSecurity
On March 19, 2026, trivy — a widely used open source vulnerability scanner maintained by Aqua Security — experienced a second security incident. Three weeks after the hackerbot-claw incident on February 28 that resulted in a repository takeover, a new compromised release (v0.69.4) was published to the trivy repository. The original incident disclosure discussion (#10265) was also deleted during this period, and version tags on the aquasecurity/setup-trivy GitHub Action were removed. Trivy maintainers deleted the v0.69.4 tag and Homebrew downgraded to v0.69.3. The following is a factual account of what we observed through public GitHub data.
www.stepsecurity.io
March 20, 2026 at 10:10 PM
The open source vulnerability scanner trivy has experienced a *second* security incident: a compromised release (v0.69.4) was published to the trivy repository.
https://www.stepsecurity.io/blog/trivy-compromised-a-second-time---malicious-v0-69-4-release
https://www.stepsecurity.io/blog/trivy-compromised-a-second-time---malicious-v0-69-4-release
Why is aquasec so much more dramatic then trivy?
Trivy: medium or low risk
Aquasec:
Trivy: medium or low risk
Aquasec:
Were Going To Die Were Gonna Die
ALT: Were Going To Die Were Gonna Die
static.klipy.com
September 23, 2026 at 6:47 PM
Why is aquasec so much more dramatic then trivy?
Trivy: medium or low risk
Aquasec:
Trivy: medium or low risk
Aquasec:
And now Trivy according to @srobert.bsky.social, his blog post (in French) : blog.stephane-robert.info/post/trivy-d...
March 1, 2026 at 6:59 PM
And now Trivy according to @srobert.bsky.social, his blog post (in French) : blog.stephane-robert.info/post/trivy-d...
-GitHub is starting to have a real malware problem
-Russian intelligence services compromise thousands of Signal accounts
-Trivy vulnerability scanner compromised for supply chain attack
-FBI takes down Aisuru, Kimwolf botnets
Newsletter: news.risky.biz/risky-bullet...
Podcast: risky.biz/RBNEWS541/
-Russian intelligence services compromise thousands of Signal accounts
-Trivy vulnerability scanner compromised for supply chain attack
-FBI takes down Aisuru, Kimwolf botnets
Newsletter: news.risky.biz/risky-bullet...
Podcast: risky.biz/RBNEWS541/
March 23, 2026 at 10:11 AM
-GitHub is starting to have a real malware problem
-Russian intelligence services compromise thousands of Signal accounts
-Trivy vulnerability scanner compromised for supply chain attack
-FBI takes down Aisuru, Kimwolf botnets
Newsletter: news.risky.biz/risky-bullet...
Podcast: risky.biz/RBNEWS541/
-Russian intelligence services compromise thousands of Signal accounts
-Trivy vulnerability scanner compromised for supply chain attack
-FBI takes down Aisuru, Kimwolf botnets
Newsletter: news.risky.biz/risky-bullet...
Podcast: risky.biz/RBNEWS541/
"The LiteLLM compromise was the result of a previous supply-chain attack that infected the widely used vulnerability scanner Trivy. TeamPCP, a ramshackle but extremely capable gang largely made up of teenagers, took credit for the attack"
August 12, 2026 at 9:54 PM
"The LiteLLM compromise was the result of a previous supply-chain attack that infected the widely used vulnerability scanner Trivy. TeamPCP, a ramshackle but extremely capable gang largely made up of teenagers, took credit for the attack"
cryptotokens, etc into three things.
- Trivy
- Trivy GitHub actions
- Trivy Docker stuff
As is tradition, once TeamPCP put malware into Trivy stuff, anyone who did anything with Trivy was given malware. TeamPCP got a metric poop ton of stolen data and began using it to move to NPM
- Trivy
- Trivy GitHub actions
- Trivy Docker stuff
As is tradition, once TeamPCP put malware into Trivy stuff, anyone who did anything with Trivy was given malware. TeamPCP got a metric poop ton of stolen data and began using it to move to NPM
March 25, 2026 at 7:24 PM
cryptotokens, etc into three things.
- Trivy
- Trivy GitHub actions
- Trivy Docker stuff
As is tradition, once TeamPCP put malware into Trivy stuff, anyone who did anything with Trivy was given malware. TeamPCP got a metric poop ton of stolen data and began using it to move to NPM
- Trivy
- Trivy GitHub actions
- Trivy Docker stuff
As is tradition, once TeamPCP put malware into Trivy stuff, anyone who did anything with Trivy was given malware. TeamPCP got a metric poop ton of stolen data and began using it to move to NPM
Another GitHub Action hack where old versions were swapped to infect CI.
socket.dev/blog/trivy-u...
It’s another example of why you should pin actions in your workflows by commit SHA, not by version tags.
For JS projects, use actions-up:
github.com/azat-io/acti...
For everything else: pinact.
socket.dev/blog/trivy-u...
It’s another example of why you should pin actions in your workflows by commit SHA, not by version tags.
For JS projects, use actions-up:
github.com/azat-io/acti...
For everything else: pinact.
Trivy Under Attack Again: Widespread GitHub Actions Tag Comp...
Attackers compromised Trivy GitHub Actions by force-updating tags to deliver malware, exposing CI/CD secrets across affected pipelines.
socket.dev
March 23, 2026 at 5:00 PM
Another GitHub Action hack where old versions were swapped to infect CI.
socket.dev/blog/trivy-u...
It’s another example of why you should pin actions in your workflows by commit SHA, not by version tags.
For JS projects, use actions-up:
github.com/azat-io/acti...
For everything else: pinact.
socket.dev/blog/trivy-u...
It’s another example of why you should pin actions in your workflows by commit SHA, not by version tags.
For JS projects, use actions-up:
github.com/azat-io/acti...
For everything else: pinact.
開発環境でコンテナ利用している場合でも、もうimageが無事かわからないので latest 運用は危険という話。
安全な image を特定したらdigest で固定したほうが良さそう。
検査済みの安全な image をプライベートリポジトリで運用するのが一番いいんだろうな。
2026年3月Trivyサプライチェーン攻撃とDockerイメージのバージョンピニング #trivy #docker #security - Tech Blog｜クリエーションライン
www.creationline.com/tech-blog/cl...
安全な image を特定したらdigest で固定したほうが良さそう。
検査済みの安全な image をプライベートリポジトリで運用するのが一番いいんだろうな。
2026年3月Trivyサプライチェーン攻撃とDockerイメージのバージョンピニング #trivy #docker #security - Tech Blog｜クリエーションライン
www.creationline.com/tech-blog/cl...
2026年3月Trivyサプライチェーン攻撃とDockerイメージのバージョンピニング #trivy #docker #security - Tech Blog｜クリエーションライン
AquaSecurity, d-higuchi, DevOps, Docker, GitLab |はじめに 2026年3月に発生した人気OSSセキュリティスキャナ「Trivy」を標的としたサプライチェーン攻撃により、多くの開発現場に激震が走りました。
www.creationline.com
March 26, 2026 at 8:57 AM
開発環境でコンテナ利用している場合でも、もうimageが無事かわからないので latest 運用は危険という話。
安全な image を特定したらdigest で固定したほうが良さそう。
検査済みの安全な image をプライベートリポジトリで運用するのが一番いいんだろうな。
2026年3月Trivyサプライチェーン攻撃とDockerイメージのバージョンピニング #trivy #docker #security - Tech Blog｜クリエーションライン
www.creationline.com/tech-blog/cl...
安全な image を特定したらdigest で固定したほうが良さそう。
検査済みの安全な image をプライベートリポジトリで運用するのが一番いいんだろうな。
2026年3月Trivyサプライチェーン攻撃とDockerイメージのバージョンピニング #trivy #docker #security - Tech Blog｜クリエーションライン
www.creationline.com/tech-blog/cl...