{"slug": "trivy", "name": "Trivy", "category": "security", "category_name": "Security and passwords", "description": "", "recommenders": 3, "commenters": 26, "warners": 15, "score": -8.445, "rising": 0.35, "first": "2025-12-28", "latest": "2026-10-15", "why": "I don't think Trivy is bad software and I use it at work", "why_is_quote": true, "has_verdict": false, "sentiment": {"recommend": 3, "neutral": 7, "compare": 1, "warn": 15}, "spark": [0, 1, 0, 0, 1, 0, 0, 0, 0, 0, 0, 1], "listed": true, "loved": [], "caveat": "", "short_quote": "I don't think Trivy is bad software and I use it at work", "kind": "", "icon": true, "domain": null, "github_repo": "github.com/aquasecurity/trivy", "official_url": "https://trivy.dev", "pricing": "", "aliases": ["Trivy", "trivy"], "verdict": null, "praise": [{"label": "", "summary": "", "quotes": [{"id": 801774400, "item_id": 50110900, "url": "https://news.ycombinator.com/item?id=50110900", "by": "bemeeker", "date": "2026-10-15", "version": null, "stance": "recommend", "quote": "scanning tools like Trivy become more useful", "excerpt": "I agree with many others in the thread. It\u2019s pretty much impossible to not install apps that have \u201cvibe coded\u201d aspects to them now, if not completely vibe coded. We see this with Amazon/AWS boasting that a large percent of their code is now AI generated. I think with that in mind, scanning tools like Trivy become more useful. I am building a tool (https://github.com/trypando/pando) to help people deploy vibe coded ap", "context": "", "use_case": "scanning vibe-coded apps", "switched_from": "", "story": "Ask HN: Are you hesitant to install vibe-coded apps?"}, {"id": 759918144, "item_id": 47494884, "url": "https://news.ycombinator.com/item?id=47494884", "by": "pxc", "date": "2026-03-23", "version": null, "stance": "recommend", "quote": "I don't think Trivy is bad software and I use it at work", "excerpt": "My hypothesis is that generally, there's no quality floor at which security departments are \"allowed\" to say \"actually, none of the options on the market in this category are good enough; we're not going to use any of them\". The norm is to reflexively accept extreme invasiveness and always say yes to adding more software to the pile. When these norms run deeply enough in a department, it's effectively institutionally", "context": "", "use_case": "Security scanning at work", "switched_from": "", "story": "Trivy Under Attack Again: Widespread GitHub Actions Tag Compromise Secrets"}, {"id": 742621682, "item_id": 46413855, "url": "https://news.ycombinator.com/item?id=46413855", "by": "kirumachi", "date": "2025-12-28", "version": null, "stance": "recommend", "quote": "They are great scanners", "excerpt": "Hi HN, I\u2019m one of the creators of Hokage. We built this because we were tired of the usuall spreadsheet hell that comes with running open-source security tools at any reasonable scale. If you are a small-to-mid-sized team, you likely use tools like Semgrep, Trivy, or Gitleaks. They are great scanners, but they all output different formats, don\u2019t talk to each other, and result in hundreds of duplicate findings that ma", "context": "", "use_case": "Vulnerability scanning", "switched_from": "", "story": "Show HN: Hokage \u2013 Unified Orchestration for Semgrep, Trivy, and Zap"}]}], "caveats": [{"label": "", "summary": "", "quotes": [{"id": 782211184, "item_id": 48888199, "url": "https://news.ycombinator.com/item?id=48888199", "by": "ashishb", "date": "2026-07-12", "version": null, "stance": "warn", "quote": "Scanners like Trivy have been compromised", "excerpt": "> Because I'm confident nothing will happen if it does Well, best of luck. 1. Amazon has shipped backdoored packages - https://aws.amazon.com/security/security-bulletins/AWS-2025-015/ 2. Scanners like Trivy have been compromised - https://socket.dev/blog/trivy-under-attack-again-github-actions-compromise 3. Redhat is shipping backdoored FOSS packages - https://access.redhat.com/security/vulnerabilities/RHSB-2026-006 ", "context": "", "use_case": "", "switched_from": "", "story": "What xAI's Grok Build CLI Actually Sends to xAI"}, {"id": 766033360, "item_id": 47877085, "url": "https://news.ycombinator.com/item?id=47877085", "by": "esafak", "date": "2026-04-23", "version": null, "stance": "warn", "quote": "Last month it was trivy", "excerpt": "Last month it was trivy: https://github.com/aquasecurity/trivy/security/advisories/GHSA-69fq-xp46-6x23", "context": "", "use_case": "", "switched_from": "", "story": "Bitwarden CLI Compromised in Ongoing Checkmarx Supply Chain"}, {"id": 764490002, "item_id": 47780625, "url": "https://news.ycombinator.com/item?id=47780625", "by": "flexorium", "date": "2026-04-15", "version": null, "stance": "warn", "quote": "Trivy got pwn'd using textbook", "excerpt": "OP here, mini AMA. Two years ago today, our small research team open sourced poutine, a SAST scanner for CI/CD pipelines (very similar to zizmor, but written in Go and customizable using Rego DSL). It finds the vulnerabilities in your build pipelines. As all security engineers know, running SAST and filing a JIRA ticket leads to nowhere. Some weeks ago TeamPCP came on the scene and most were shocked to see the blast ", "context": "", "use_case": "", "switched_from": "", "story": "Show HN: SmokedMeat, like Metasploit, but for CI/CD (open-source)"}, {"id": 760910353, "item_id": 47556897, "url": "https://news.ycombinator.com/item?id=47556897", "by": "alegrey91", "date": "2026-03-28", "version": null, "stance": "warn", "quote": "trivy/grype still flag CVEs that aren't actually exploitable", "excerpt": "If you run hardened containers (readOnlyRootFilesystem, runAsNonRoot, resource limits, etc.), you've probably noticed that trivy/grype still flag CVEs that aren't actually exploitable in your environment. There's no standard way to say \"this CVE doesn't apply to my deployment.\" vex8s bridges that gap. It uses an embedded ML model to classify each CVE by exploitation type (arbitrary file write, privilege escalation, r", "context": "", "use_case": "", "switched_from": "", "story": "Vex8s: Suppress container CVEs that your Kubernetes settings mitigates"}]}], "who": [], "tags": [], "use_cases": ["security scanning", "vulnerability scanning", "scanning vibe-coded apps", "security verification", "ci security scanning", "security scanning at work"], "compared": [{"slug": "litellm", "name": "LiteLLM", "co": 3, "switched_from": 0, "switched_to": 0}, {"slug": "zizmor", "name": "zizmor", "co": 2, "switched_from": 0, "switched_to": 0}, {"slug": "semgrep", "name": "Semgrep", "co": 2, "switched_from": 0, "switched_to": 0}], "makers": [], "threads": [{"url": "https://news.ycombinator.com/item?id=47501729", "title": "LiteLLM Python package compromised by supply-chain attack", "mentions": 6}, {"url": "https://news.ycombinator.com/item?id=47450142", "title": "item 47450142", "mentions": 5}, {"url": "https://news.ycombinator.com/item?id=47475888", "title": "Trivy Under Attack Again: Widespread GitHub Actions Tag Compromise Secrets", "mentions": 3}, {"url": "https://news.ycombinator.com/item?id=50090796", "title": "Ask HN: Are you hesitant to install vibe-coded apps?", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=49297312", "title": "item 49297312", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=48877371", "title": "What xAI's Grok Build CLI Actually Sends to xAI", "mentions": 1}], "sentiment_by_month": {"2025-11": {}, "2025-12": {"recommend": 1}, "2026-01": {"neutral": 1}, "2026-02": {"neutral": 1}, "2026-03": {"warn": 12, "neutral": 4, "recommend": 1, "compare": 1}, "2026-04": {"warn": 2}, "2026-05": {}, "2026-06": {}, "2026-07": {"warn": 1}, "2026-08": {"neutral": 1}, "2026-09": {}, "2026-10": {"recommend": 1}}, "versions": [], "version_unnamed": 0, "family_ref": null, "runs_on": null, "lines": [], "quotes": [{"id": 801774400, "item_id": 50110900, "url": "https://news.ycombinator.com/item?id=50110900", "by": "bemeeker", "date": "2026-10-15", "version": null, "stance": "recommend", "quote": "scanning tools like Trivy become more useful", "excerpt": "I agree with many others in the thread. It\u2019s pretty much impossible to not install apps that have \u201cvibe coded\u201d aspects to them now, if not completely vibe coded. We see this with Amazon/AWS boasting that a large percent of their code is now AI generated. I think with that in mind, scanning tools like Trivy become more useful. I am building a tool (https://github.com/trypando/pando) to help people deploy vibe coded ap", "context": "", "use_case": "scanning vibe-coded apps", "switched_from": "", "story": "Ask HN: Are you hesitant to install vibe-coded apps?"}, {"id": 788757011, "item_id": 49297313, "url": "https://news.ycombinator.com/item?id=49297313", "by": "seantheviking", "date": "2026-08-14", "version": null, "stance": "neutral", "quote": "we have semgrep, trivy and kerno running in the verfication pipelines", "excerpt": "What turned out as something to solve internal engineering problems at Kerno has now taken a life of it's own. Today we are releasing HarHQ, a way for you to implement, run and visualise your entire AI software factory in under 10 minutes. It's built on top of .HAR, an open-harness to run fleets of agents securely. Chatting with CTO/VP of Engineering from startups to F100, the challenges of factory build out are the ", "context": "", "use_case": "security verification", "switched_from": "", "story": null}, {"id": 782211184, "item_id": 48888199, "url": "https://news.ycombinator.com/item?id=48888199", "by": "ashishb", "date": "2026-07-12", "version": null, "stance": "warn", "quote": "Scanners like Trivy have been compromised", "excerpt": "> Because I'm confident nothing will happen if it does Well, best of luck. 1. Amazon has shipped backdoored packages - https://aws.amazon.com/security/security-bulletins/AWS-2025-015/ 2. Scanners like Trivy have been compromised - https://socket.dev/blog/trivy-under-attack-again-github-actions-compromise 3. Redhat is shipping backdoored FOSS packages - https://access.redhat.com/security/vulnerabilities/RHSB-2026-006 ", "context": "", "use_case": "", "switched_from": "", "story": "What xAI's Grok Build CLI Actually Sends to xAI"}, {"id": 766033360, "item_id": 47877085, "url": "https://news.ycombinator.com/item?id=47877085", "by": "esafak", "date": "2026-04-23", "version": null, "stance": "warn", "quote": "Last month it was trivy", "excerpt": "Last month it was trivy: https://github.com/aquasecurity/trivy/security/advisories/GHSA-69fq-xp46-6x23", "context": "", "use_case": "", "switched_from": "", "story": "Bitwarden CLI Compromised in Ongoing Checkmarx Supply Chain"}, {"id": 764490002, "item_id": 47780625, "url": "https://news.ycombinator.com/item?id=47780625", "by": "flexorium", "date": "2026-04-15", "version": null, "stance": "warn", "quote": "Trivy got pwn'd using textbook", "excerpt": "OP here, mini AMA. Two years ago today, our small research team open sourced poutine, a SAST scanner for CI/CD pipelines (very similar to zizmor, but written in Go and customizable using Rego DSL). It finds the vulnerabilities in your build pipelines. As all security engineers know, running SAST and filing a JIRA ticket leads to nowhere. Some weeks ago TeamPCP came on the scene and most were shocked to see the blast ", "context": "", "use_case": "", "switched_from": "", "story": "Show HN: SmokedMeat, like Metasploit, but for CI/CD (open-source)"}, {"id": 760910353, "item_id": 47556897, "url": "https://news.ycombinator.com/item?id=47556897", "by": "alegrey91", "date": "2026-03-28", "version": null, "stance": "warn", "quote": "trivy/grype still flag CVEs that aren't actually exploitable", "excerpt": "If you run hardened containers (readOnlyRootFilesystem, runAsNonRoot, resource limits, etc.), you've probably noticed that trivy/grype still flag CVEs that aren't actually exploitable in your environment. There's no standard way to say \"this CVE doesn't apply to my deployment.\" vex8s bridges that gap. It uses an embedded ML model to classify each CVE by exploitation type (arbitrary file write, privilege escalation, r", "context": "", "use_case": "", "switched_from": "", "story": "Vex8s: Suppress container CVEs that your Kubernetes settings mitigates"}, {"id": 760426593, "item_id": 47526662, "url": "https://news.ycombinator.com/item?id=47526662", "by": "detente18", "date": "2026-03-25", "version": null, "stance": "warn", "quote": "We can confirm a bad version of Trivy security scanner ran in our CI/CD pipeline", "excerpt": "Update 2 (03/25/2026): - We will be holding a townhall on Friday to review the incident and share next steps (https://lnkd.in/gsbTdCe7) - We can confirm a bad version of Trivy security scanner ran in our CI/CD pipeline, which would have led to the supply chain attack - We have paused new releases until we've completed securing our codebase and release pipeline to ensure safe releases for users - We've added additiona", "context": "", "use_case": "", "switched_from": "", "story": "LiteLLM Python package compromised by supply-chain attack"}, {"id": 760210704, "item_id": 47513169, "url": "https://news.ycombinator.com/item?id=47513169", "by": "h4kunamata", "date": "2026-03-24", "version": null, "stance": "warn", "quote": "Still compromised: https://socket.dev/blog/trivy-under-attack-again-github-actions-compromise", "excerpt": "Still compromised: https://socket.dev/blog/trivy-under-attack-again-github-actions-compromise This is a very old vulnerability, and to see companies falling for it is mental. The year is 2026 and companies are still using tag over hash. It is well known that you can release different code under the same tag without alerting users.", "context": "", "use_case": "", "switched_from": "", "story": null}, {"id": 760166673, "item_id": 47510417, "url": "https://news.ycombinator.com/item?id=47510417", "by": "ij23", "date": "2026-03-24", "version": null, "stance": "warn", "quote": "the compromise originated from the Trivy dependency used in our CI/CD security scanning workflow", "excerpt": "Hi all, Ishaan from LiteLLM here (LiteLLM maintainer) The compromised PyPI packages were litellm==1.82.7 and litellm==1.82.8. Those packages have now been removed from PyPI. We have confirmed that the compromise originated from the Trivy dependency used in our CI/CD security scanning workflow. All maintainer accounts have been rotated. The new maintainer accounts are @krrish-berri-2 and @ishaan-berri. Customers runni", "context": "", "use_case": "CI security scanning", "switched_from": "", "story": "LiteLLM Python package compromised by supply-chain attack"}, {"id": 760163552, "item_id": 47510222, "url": "https://news.ycombinator.com/item?id=47510222", "by": "jimmySixDOF", "date": "2026-03-24", "version": null, "stance": "compare", "quote": "Not sure that Trivy was doing that itself", "excerpt": "Not sure that Trivy was doing that itself but zizmor is probably better than starting with an LLM : https://github.com/zizmorcore/zizmor", "context": "", "use_case": "", "switched_from": "", "story": "LiteLLM Python package compromised by supply-chain attack"}, {"id": 760125376, "item_id": 47507836, "url": "https://news.ycombinator.com/item?id=47507836", "by": "santiago-pl", "date": "2026-03-24", "version": null, "stance": "warn", "quote": "It looks like Trivy was compromised at least five days ago.", "excerpt": "It looks like Trivy was compromised at least five days ago. https://www.wiz.io/blog/trivy-compromised-teampcp-supply-chain-attack", "context": "", "use_case": "", "switched_from": "", "story": "Tell HN: Litellm 1.82.7 and 1.82.8 on PyPI are compromised"}, {"id": 760107856, "item_id": 47506741, "url": "https://news.ycombinator.com/item?id=47506741", "by": "celticninja", "date": "2026-03-24", "version": null, "stance": "warn", "quote": "The safe thing to do is remove all trivy access.", "excerpt": "69.3 isnt safe. The safe thing to do is remove all trivy access. or failing that version. 0.35 is the last and AFAIK only safe version. https://socket.dev/blog/trivy-under-attack-again-github-actions-compromise", "context": "", "use_case": "", "switched_from": "", "story": "LiteLLM Python package compromised by supply-chain attack"}, {"id": 760101664, "item_id": 47506354, "url": "https://news.ycombinator.com/item?id=47506354", "by": "Imustaskforhelp", "date": "2026-03-24", "version": null, "stance": "warn", "quote": "Trivvy hacked (https://www.aquasec.com/blog/trivy-supply-chain-attack-what-you-need-to-know/)", "excerpt": "They have written about it on github to my question: Trivvy hacked (https://www.aquasec.com/blog/trivy-supply-chain-attack-what-you-need-to-know/) -> all circleci credentials leaked -> included pypi publish token + github pat -> | WE DISCOVER ISSUE | -> pypi token deleted, github pat deleted + account removed from org access, trivvy pinned to last known safe version (v0.69.3) What we're doing now: Block all releases,", "context": "", "use_case": "security scanning", "switched_from": "", "story": "LiteLLM Python package compromised by supply-chain attack"}, {"id": 760045728, "item_id": 47502858, "url": "https://news.ycombinator.com/item?id=47502858", "by": "detente18", "date": "2026-03-24", "version": null, "stance": "warn", "quote": "Looks like this originated from the trivvy used in our ci/cd", "excerpt": "LiteLLM maintainer here, this is still an evolving situation, but here's what we know so far: 1. Looks like this originated from the trivvy used in our ci/cd - https://github.com/search?q=repo%3ABerriAI%2Flitellm%20trivy&type=code https://ramimac.me/trivy-teampcp/#phase-09 2. If you're on the proxy docker, you were not impacted. We pin our versions in the requirements.txt 3. The package is in quarantine on pypi - thi", "context": "", "use_case": "", "switched_from": "", "story": "LiteLLM Python package compromised by supply-chain attack"}, {"id": 760022496, "item_id": 47501406, "url": "https://news.ycombinator.com/item?id=47501406", "by": "mkesper", "date": "2026-03-24", "version": null, "stance": "neutral", "quote": "It needs internet access for upgrading the check bundle", "excerpt": "It needs internet access for upgrading the check bundle and for full Java library resolution (pom.xml). See e.g. https://github.com/aquasecurity/trivy/discussions/9698", "context": "", "use_case": "", "switched_from": "", "story": "Trivy Under Attack Again: Widespread GitHub Actions Tag Compromise Secrets"}, {"id": 760010896, "item_id": 47500681, "url": "https://news.ycombinator.com/item?id=47500681", "by": "r0nan", "date": "2026-03-24", "version": null, "stance": "warn", "quote": "So this is how Trivy got turned into a supply chain attack nightmare.", "excerpt": "So this is how Trivy got turned into a supply chain attack nightmare. On March 4, commit 1885610c landed in aquasecurity/trivy with the message fix(ci): Use correct checkout pinning, attributed to DmitriyLewen (who's a legit maintainer). The diff touched two workflow files across 14 lines, and most of it was noise like single quotes swapped for double quotes, a trailing space removed from a mkdir line. It was the kin", "context": "", "use_case": "security scanning", "switched_from": "", "story": null}, {"id": 759918144, "item_id": 47494884, "url": "https://news.ycombinator.com/item?id=47494884", "by": "pxc", "date": "2026-03-23", "version": null, "stance": "recommend", "quote": "I don't think Trivy is bad software and I use it at work", "excerpt": "My hypothesis is that generally, there's no quality floor at which security departments are \"allowed\" to say \"actually, none of the options on the market in this category are good enough; we're not going to use any of them\". The norm is to reflexively accept extreme invasiveness and always say yes to adding more software to the pile. When these norms run deeply enough in a department, it's effectively institutionally", "context": "", "use_case": "Security scanning at work", "switched_from": "", "story": "Trivy Under Attack Again: Widespread GitHub Actions Tag Compromise Secrets"}, {"id": 759878480, "item_id": 47492405, "url": "https://news.ycombinator.com/item?id=47492405", "by": "Shank", "date": "2026-03-23", "version": null, "stance": "warn", "quote": "publish a malicious Trivy v0.69.5 and v0.69.6 DockerHub images", "excerpt": "> On March 22, 2026, a threat actor used compromised credentials to publish a malicious Trivy v0.69.5 and v0.69.6 DockerHub images. (https://github.com/aquasecurity/trivy/security/advisories/GHSA-69fq-xp46-6x23) So the first incident was on March 19th and the second incident is March 22nd \u2014- evidently the attackers maintained persistence through maybe two separate credential rotation efforts.", "context": "", "use_case": "", "switched_from": "", "story": "Trivy Under Attack Again: Widespread GitHub Actions Tag Compromise Secrets"}, {"id": 759836304, "item_id": 47489769, "url": "https://news.ycombinator.com/item?id=47489769", "by": "KuhlMensch", "date": "2026-03-23", "version": null, "stance": "neutral", "quote": "Someone else with same issue", "excerpt": "Someone else with same issue https://github.com/aquasecurity/trivy/discussions/10425#discussioncomment-16273845", "context": "", "use_case": "", "switched_from": "", "story": "Aqua Security locking down trivvy gh; Restricting to allowlist of IPs"}, {"id": 759831520, "item_id": 47489470, "url": "https://news.ycombinator.com/item?id=47489470", "by": "Shank", "date": "2026-03-23", "version": null, "stance": "warn", "quote": "their Docker images have now been compromised", "excerpt": "It seems not enough again, as their Docker images have now been compromised (as of March 22nd, 2026): https://github.com/aquasecurity/trivy/security/advisories/GHSA-69fq-xp46-6x23", "context": "", "use_case": "", "switched_from": "", "story": null}, {"id": 759800080, "item_id": 47487505, "url": "https://news.ycombinator.com/item?id=47487505", "by": "philipwhiuk", "date": "2026-03-23", "version": null, "stance": "warn", "quote": "Sounds like Trivy is still compromised", "excerpt": "Sounds like Trivy is still compromised: https://www.aquasec.com/blog/trivy-supply-chain-attack-what-you-need-to-know/", "context": "", "use_case": "Vulnerability scanning", "switched_from": "", "story": null}, {"id": 759761840, "item_id": 47485115, "url": "https://news.ycombinator.com/item?id=47485115", "by": "gnabgib", "date": "2026-03-22", "version": null, "stance": "neutral", "quote": "Mentioned by both\n\nTrivy (aquasecurity)", "excerpt": "Mentioned by both Trivy (aquasecurity) (84 points, 3 days ago, 30 comments) https://news.ycombinator.com/item?id=47450142 Wiz (3 points) https://www.wiz.io/blog/trivy-compromised-teampcp-supply-chain-attack", "context": "", "use_case": "", "switched_from": "", "story": "Trivy Supply Chain Attack Expands to Compromised Docker Images"}, {"id": 759595361, "item_id": 47474710, "url": "https://news.ycombinator.com/item?id=47474710", "by": "AdrienPoupa", "date": "2026-03-21", "version": null, "stance": "neutral", "quote": "", "excerpt": "That's true. This specific attack was mitigated by hash pinning, but some actions like https://github.com/1Password/load-secrets-action default to using the latest version of an underlying dependency.", "context": "", "use_case": "Vulnerability scanner", "switched_from": "", "story": null}, {"id": 759580176, "item_id": 47473761, "url": "https://news.ycombinator.com/item?id=47473761", "by": "Shank", "date": "2026-03-21", "version": null, "stance": "warn", "quote": "they failed to successfully remediate and contain the damage", "excerpt": "This attack seems predicated on a prior security incident (https://socket.dev/blog/unauthorized-ai-agent-execution-code-published-to-openvsx-in-aqua-trivy-vs-code-extension) at Trivy where they failed to successfully remediate and contain the damage. I think at this time, Trivy should\u2019ve undertaken a full reassessment of risks and clearly isolated credentials and reduced risk systemically. This did not happen, and th", "context": "", "use_case": "Security scanning", "switched_from": "", "story": null}, {"id": 759548896, "item_id": 47471806, "url": "https://news.ycombinator.com/item?id=47471806", "by": "JoshuaDavid", "date": "2026-03-21", "version": null, "stance": "warn", "quote": "Trivy (a very widely-used security scanner) was recently compromised.", "excerpt": "Trivy (a very widely-used security scanner) was recently compromised. Anyone who installed the aquasecurity/trivy-action dependency by tag rather than by sha during a 3 hour period on March 19 was likely compromised. There is a Github security advisory at https://github.com/aquasecurity/trivy/security/advisories/GHSA-69fq-xp46-6x23 6 separate people have tried to submit this to HN. All of the submissions are marked a", "context": "", "use_case": "security scanner", "switched_from": "", "story": "Attempts to post the latest Trivy security incident have been marked [dead]"}, {"id": 759192672, "item_id": 47449542, "url": "https://news.ycombinator.com/item?id=47449542", "by": "mmsc", "date": "2026-03-19", "version": null, "stance": "warn", "quote": "Any system with Trivy 0.69.4 on it (and being run) can be assumed to be compromised.", "excerpt": "The offending commit seems to be: https://github.com/aquasecurity/trivy/commit/1885610c6a34811c8296416ae69f568002ef11ec which updates the action to `actions/checkout@70379aad1a8b40919ce8b382d3cd7d0315cde1d0 # v6.0.2`. https://github.com/actions/checkout/commit/70379aad1a8b40919ce8b382d3cd7d0315cde1d0 is not actually in `actions/checkout` but a fork, and it pulls malicious code from the typo-squatted \"scan.aquasecurti", "context": "", "use_case": "", "switched_from": "", "story": "Aquasecurity/Trivy GitHub Repository and Homebrew Cask Compromised (again)"}, {"id": 750572753, "item_id": 46910797, "url": "https://news.ycombinator.com/item?id=46910797", "by": "bsgeraci", "date": "2026-02-06", "version": null, "stance": "neutral", "quote": "I am using the openscap and trivia.", "excerpt": "I am using the openscap and trivia. Can you add a discussion to my github about some of this. I would love some of your feedback on what you need on your level. I need to check the update mechanism so we are keeping the database up to date. I also want a way to keep it up to date when it is airgapped, not everyones use case but one I have delt with at my jobs. I still need to put some e2e testing on those policies. h", "context": "", "use_case": "", "switched_from": "", "story": null}, {"id": 745117504, "item_id": 46569844, "url": "https://news.ycombinator.com/item?id=46569844", "by": "DigitallyBorn", "date": "2026-01-10", "version": null, "stance": "neutral", "quote": "I use it for Terraform for guidance", "excerpt": "The use of Trivy is really just an interesting context for post. I use it for Terraform for guidance. I know it\u2019s used by some teams at Splunk. I couldn\u2019t possibly answer a question about what every one of the 86,000 Cisco employees does. Re: em dashes\u2014 I type with double-hyphens a lot. I guess my blog software (Jekyll) doesn\u2019t convert them into real em dashes, but I didn\u2019t notice until you mentioned it.", "context": "", "use_case": "Terraform guidance", "switched_from": "", "story": "Working with multiple repositories in AI tools sucks"}, {"id": 742621682, "item_id": 46413855, "url": "https://news.ycombinator.com/item?id=46413855", "by": "kirumachi", "date": "2025-12-28", "version": null, "stance": "recommend", "quote": "They are great scanners", "excerpt": "Hi HN, I\u2019m one of the creators of Hokage. We built this because we were tired of the usuall spreadsheet hell that comes with running open-source security tools at any reasonable scale. If you are a small-to-mid-sized team, you likely use tools like Semgrep, Trivy, or Gitleaks. They are great scanners, but they all output different formats, don\u2019t talk to each other, and result in hundreds of duplicate findings that ma", "context": "", "use_case": "Vulnerability scanning", "switched_from": "", "story": "Show HN: Hokage \u2013 Unified Orchestration for Semgrep, Trivy, and Zap"}]}