Trivy ecosystem supply chain temporarily compromised

Summary

On March 19, 2026, a threat actor used compromised credentials to publish a malicious Trivy v0.69.4 release, force-push 76 of 77 version tags in

aquasecurity/setup-trivy

On March 22, 2026, a threat actor used compromised credentials to publish a malicious Trivy v0.69.5 and v0.69.6 DockerHub images.

Exposure Window

Component

aquasecurity/trivy-action

with malicious commits.

trivy v0.69.4

trivy-action

setup-trivy

dockerhub trivy images v0.69.5 and v0.69.6

Affected Components

Note that all malicious components, artifacts, commits, etc have been removed from all sources and destinations (yet they may lin…