The widely-used open-source vulnerability scanner Trivy, maintained by Aqua Security, has been compromised for a second time. A malicious release (v0.69.4) was published to its repository on March 19, 2026, following a previous repository takeover incident in late February. This represents a critical supply chain attack on a key security tool used in CI/CD pipelines.
Background
Trivy is a popular open-source vulnerability scanner used to find security issues in container images, file systems, and Git repositories. It is widely integrated into CI/CD pipelines via GitHub Actions (aquasecurity/setup-trivy, aquasecurity/trivy-action).
- Source
- Lobsters
- Published
- Mar 21, 2026 at 01:55 AM
- Score
- 9.0 / 10