Hacker GitHub

← All repos

aquasecurity/trivy

View on GitHub ↗ ★ 38,907 Go

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

29 mentions on Hacker News by 23 people: 4 stories, 25 comments · first 2020-07-29 · latest 2026-04-23

Mentions per year 29 mentions · busiest year 2026 (12)
20082026
AllStoriesComments NewestTopOldest
  1. Last month it was trivy: https://github.com/aquasecurity/trivy/security/advisories/GH...
    comment by esafak · 2026-04-23 · in Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign
  2. Attackers trying to stifle discussion, they did the same for trivy: https://github.com/aquasecurity/trivy/discussions/10420
    comment by bakugo · 2026-03-24 · in Tell HN: Litellm 1.82.7 and 1.82.8 on PyPI are compromised
  3. …access for upgrading the check bundle and for full Java library resolution (pom.xml). See e.g. https://github.com/aquasecurity/trivy/discussions/9698
    comment by mkesper · 2026-03-24 · in Trivy under attack again: Widespread GitHub Actions tag compromise secrets
  4. …used compromised credentials to publish a malicious Trivy v0.69.5 and v0.69.6 DockerHub images. ( https://github.com/aquasecurity/trivy/security/advisories/GH... ) So the first incident was on March 19th and the second incident is March…
    comment by Shank · 2026-03-23 · in Trivy under attack again: Widespread GitHub Actions tag compromise secrets
  5. Someone else with same issue https://github.com/aquasecurity/trivy/discussions/10425#disc...
    comment by KuhlMensch · 2026-03-23 · in Aqua Security locking down trivvy gh; Restricting to allowlist of IPs
  6. It seems not enough again, as their Docker images have now been compromised (as of March 22nd, 2026): https://github.com/aquasecurity/trivy/security/advisories/GH...
    comment by Shank · 2026-03-23 · in Trivy ecosystem supply chain temporarily compromised
  7. …the HN post was merged. My original comment was in response to this related github discussion: https://github.com/aquasecurity/trivy/discussions/10420 There are hundreds of automated spam comments there from presumably compromised…
    comment by snailmailman · 2026-03-22 · in Trivy ecosystem supply chain temporarily compromised
  8. …during a 3 hour period on March 19 was likely compromised. There is a Github security advisory at https://github.com/aquasecurity/trivy/security/advisories/GH... 6 separate people have tried to submit this to HN. All of the submissions are…
    comment by JoshuaDavid · 2026-03-21 · in Attempts to post the latest Trivy security incident have been marked [dead]
  9. …Current GitHub discussion (the old discussion was removed by the attacker): https://github.com/aquasecurity/trivy/discussions/10420
    comment by man8alexd · 2026-03-20 · in Aquasecurity/Trivy GitHub Repository and Homebrew Cask Compromised (again)
  10. The offending commit seems to be: https://github.com/aquasecurity/trivy/commit/1885610c6a34811... which updates the action to `actions/checkout@70379aad1a8b40919ce8b382d3cd7d0315cde1d0 # v6.0.2`. https://github.com/actions/checkout/commit/7…
    comment by mmsc · 2026-03-20 · in Aquasecurity/Trivy GitHub Repository and Homebrew Cask Compromised (again)
  11. …examples of my usage in the wild ("response times may be slower" is present verbatim on each page): https://github.com/aquasecurity/trivy/discussions/8133 https://www.ameristarstaffingny.com/the-negative-effects-of-...…
    comment by lolinder · 2025-05-11 · in A critical look at MCP
  12. …Trivy has a pretty good collection of examples that is used for its secret scanning functionality, https://github.com/aquasecurity/trivy/blob/main/pkg/fanal/se... .
    comment by finnigja · 2025-03-25 · in Ask HN: Has anyone adopted or seen adoption of RFC8959 secret-token?
  13. …https://github.com/anchore/grype/ https://github.com/eliasgranderubio/dagda/ https://github.com/aquasecurity/trivy So then you set up something like a cron job to scan everything for you and email the results once a week or whatever if
    comment by eyegor · 2024-01-28 · in I looked through attacks in my access logs
  14. …build it to compile a new version. Which seems to be a major drawback of discouraging fat apps. 1: https://github.com/aquasecurity/trivy 2: https://github.com/rust-secure-code/cargo-auditable
    comment by wongarsu · 2023-01-30 · in Swift Achieved Dynamic Linking Where Rust Couldn't (2019)
  15. I like trivy[1] a lot. Nice to see more alternatives like this. 1. https://github.com/aquasecurity/trivy
    comment by xiwenc · 2022-12-18 · in Vulnerability scanner written in Go that uses osv.dev data
  16. …: Kubernetes security, api-machinery and operators, security tool orchastration. - https://github.com/aquasecurity/trivy : Vulnerability and misconfiguration scanning, image/packages/code, static analysis. -…
    comment by itaysk · 2022-01-03 · in Ask HN: Who is hiring? (January 2022)
  17. …that anybody could include + minimal python wrapper to document it. https://www.opencve.io/welcome https://github.com/aquasecurity/trivy https://github.com/greenbone/openvas-scanner
    comment by sensiblesec · 2021-11-07 · in Show HN: Easy to use vulnerability exploitation data to help patching
  18. …a way of injecting into any web input/output, but then you need to be scanning for that too) [1] https://github.com/aquasecurity/trivy
    comment by bjpirt · 2021-11-04 · in Ask HN: How do you security-audit external software using NPM packages?
  19. …to work on: - https://github.com/aquasecurity/starboard : Golang, Kubernetes, K8s operator. - https://github.com/aquasecurity/trivy : Golang, OPA, vulnerabilities & Infrastructure as Code scanning. I'm the hiring manager, feel free to DM…
    comment by itaysk · 2021-08-12 · in Ask HN: Who is hiring? (August 2021)
  20. …: Golang, Kubernetes, K8s operator. - Open Source engineer for working on https://github.com/aquasecurity/trivy : Golang, OPA, vulnerabilities & Infrastructure as Code scanning. I'm the hiring manager, feel free to DM me on twitter
    comment by itaysk · 2021-06-03 · in Ask HN: Who is hiring? (June 2021)
  21. …- Golang / Kubernetes engineer for https://github.com/aquasecurity/starboard - Golang engineer for https://github.com/aquasecurity/trivy - eBPF/kernel developer for https://github.com/aquasecurity/tracee I'm the hiring manager, feel free…
    comment by itaysk · 2021-05-05 · in Ask HN: Who is hiring? (May 2021)
  22. …- Golang / Kubernetes engineer for https://github.com/aquasecurity/starboard - Golang engineer for https://github.com/aquasecurity/trivy - eBPF/kernel developer for https://github.com/aquasecurity/tracee I'm the hiring manager, feel free…
    comment by itaysk · 2021-04-14 · in Ask HN: Who is hiring? (April 2021)
  23. +1 for hadolint. There's also https://github.com/goodwithtech/dockle and https://github.com/aquasecurity/trivy if you want more security emphasis.
    comment by vsupalov · 2021-01-03 · in Dockerfile Best Practices
  24. …into this yesterday as I have a bunch of containers running on my media server. Found this tool: https://github.com/aquasecurity/trivy which allows you to easily scan your images for vulns. Anyone have other recs?
    comment by sprt · 2020-12-17 · in 51% of 4M Docker images have critical vulnerabilities
  25. https://github.com/aquasecurity/trivy 110% recommended.
    comment by netsectoday · 2020-07-29 · in Zoom Security Exploit: Cracking private meeting passwords