Aqua Security
2 mentions across all digests
Aqua Security is a cybersecurity company that develops and maintains Trivy, an open-source vulnerability scanner widely used in CI/CD pipelines, which suffered a supply chain compromise in March 2026.
Widely used Trivy scanner compromised in ongoing supply-chain attack
Aqua Security's Trivy vulnerability scanner was compromised via stolen credentials, allowing attackers to inject malware into 75+ pipeline action tags that silently exfiltrate GitHub tokens, cloud credentials, and SSH keys to attacker servers.
Trivy Compromised a Second Time - Malicious v0.69.4 Release
Aqua Security's widely-used Trivy vulnerability scanner was compromised for the second time in three weeks, with malicious v0.69.4 shipping credential harvesting inside the setup-trivy GitHub Action.