Trivy
Fewer than 5 people recommend it so far, so there's no written verdict. Here is what commenters said.
3recommend
15warn against
Dec 28, 2025first mention
Oct 15, 2026latest mention
Why people recommend it
“scanning tools like Trivy become more useful”
“I don't think Trivy is bad software and I use it at work”
Show 1 more
“They are great scanners”
Caveats and dissent
“Scanners like Trivy have been compromised”
“Last month it was trivy”
Show 2 more
“Trivy got pwn'd using textbook”
“trivy/grype still flag CVEs that aren't actually exploitable”
Often compared with
Threads where it came up
- LiteLLM Python package compromised by supply-chain attack 6 mentions
- item 47450142 5 mentions
- Trivy Under Attack Again: Widespread GitHub Actions Tag Compromise Secrets 3 mentions
- Ask HN: Are you hesitant to install vibe-coded apps? 1 mention
- item 49297312 1 mention
- What xAI's Grok Build CLI Actually Sends to xAI 1 mention
Also written as trivy. Data: trivy.json. Quotes are verbatim; the verdict and theme labels are written by a model from these comments, and every clause links to its sources.
All comments 29
“scanning tools like Trivy become more useful”
“we have semgrep, trivy and kerno running in the verfication pipelines”
“Scanners like Trivy have been compromised”
“Last month it was trivy”
“Trivy got pwn'd using textbook”
“trivy/grype still flag CVEs that aren't actually exploitable”
“We can confirm a bad version of Trivy security scanner ran in our CI/CD pipeline”
“Still compromised: https://socket.dev/blog/trivy-under-attack-again-github-actions-compromise”
“the compromise originated from the Trivy dependency used in our CI/CD security scanning workflow”
“Not sure that Trivy was doing that itself”
“It looks like Trivy was compromised at least five days ago.”
“The safe thing to do is remove all trivy access.”
“Trivvy hacked (https://www.aquasec.com/blog/trivy-supply-chain-attack-what-you-need-to-know/)”
“Looks like this originated from the trivvy used in our ci/cd”
“It needs internet access for upgrading the check bundle”
“So this is how Trivy got turned into a supply chain attack nightmare.”
“I don't think Trivy is bad software and I use it at work”
“publish a malicious Trivy v0.69.5 and v0.69.6 DockerHub images”
“Someone else with same issue”
“their Docker images have now been compromised”
“Sounds like Trivy is still compromised”
“Mentioned by both Trivy (aquasecurity)”
That's true. This specific attack was mitigated by hash pinning, but some actions like https://github.com/1Password/load-secrets-action default to using the latest version of an underlying dependency.
“they failed to successfully remediate and contain the damage”
“Trivy (a very widely-used security scanner) was recently compromised.”
“Any system with Trivy 0.69.4 on it (and being run) can be assumed to be compromised.”
“I am using the openscap and trivia.”
“I use it for Terraform for guidance”
“They are great scanners”