🧰 Trivy

The items that name it 32

• Argus – a free, open-source agentic security operations platform – MIT
  toolas classification.technologies2026-10-24
• Software supply chain security best practices for 2026
  articleas affected products2026-10-21
• What We Can Learn About GitHub Actions Security from the Trivy Breach | Endor Labs
  articleas affected products2026-10-16It is written here as Trivy (open-source vulnerability scanner maintained by Aqua Security).

  open-source vulnerability scanner maintained by Aqua Security

• The OpenSourceMalware Show #25
  talkas affected products2026-10-15
• New research: malware in open source ecosystems surges 14x as attackers hijack trusted packages | Endor Labs
  articleas tools2026-10-12It is written here as Trivy (named as a compromised package in the TeamPCP campaign).

  named as a compromised package in the TeamPCP campaign

• https://github.com/dmdhrumilmistry/security-harness
  repoas tools2026-09-29

  CVE scanning tool (alternative to grype)

• Shor
  repoas tools2026-09-19

  White-box static analysis: vulnerability/misconfiguration scanning

• SolarWinds took a nation-state. The next attack just needs an LLM and $5. | Blog | Endor Labs
  articleas affected products2026-09-11

  Tool whose GitHub Actions were compromised by TeamPCP; initial entry point via a pull_request_target workflow with full secret access to code from untrusted forks; 75 version tags got poisoned overnight via mutable Git tags.

• numasec
  repoas tools2026-08-27

  local tool the numasec agent can use or reason around (vulnerability/dependency scanning)

• Socket: How AI Agents Expand the Software Supply Chain Attack Surface
  talkas affected products2026-08-17

  supply chain attack incident referenced

• Team PCP Stole 78,330 Secrets From 2,186 Organizations. CloudSEK Just Published the List.
  articleas classification.technologies2026-08-15
• From Container Escape to Cloud Takeover
  writeupas classification.technologies2026-07-26
• OpenSourceMalware Blog
  articleas affected products2026-07-18

  CI pipeline credential theft was starting point of TeamPCP's cascading supply chain attack.

• deep-scan
  repoas tools2026-07-14

  Shared Trivy server referenced in deployment docs (used as part of scanning infrastructure)

• LocxZ/SecureSDLC-Lab
  repoas tools2026-07-14

  SCA/dependency scanning, Docker image scanning, Dockerfile scanning, Kubernetes manifest scanning

• GitHub Secret Scanning Public Monitoring for Enterprises: Coverage and Gaps
  articleas affected products2026-07-12

  Compromised a second time by TeamPCP campaigns

• apisec-inc/AI-Surface
  repoas tools2026-07-11

  Container image scanning (cited as analogous pre-merge check for another layer)

• 10 Layers Deep: How StepSecurity Stops TeamPCP's Trivy Supply Chain Attack on GitHub Actions
  writeupas classification.technologies2026-07-02
• And another one. GitHub ships break-glass credential revocation
  articleas classification.technologies2026-07-01
• Orca: 8 Container Security Best Practices for 2026
  articleas tools2026-06-11It is written here as Trivy (image/filesystem CVE scanning for OS packages, language packages, IaC files, Kubernetes).

  image/filesystem CVE scanning for OS packages, language packages, IaC files, Kubernetes

• The Software Supply Chain Malware Landscape: January - May 2026
  articleas affected products2026-06-03

  Package compromised by TeamPCP in March, the beginning of their high-profile ATO campaign.

• CVE Lite CLI
  repoas tools2026-05-31

  Runs alongside CVE Lite CLI as a required merge gate at the Government of British Columbia's Ministry of Citizens' Services.

• Bringing full YAML anchor support to zizmor
  articleas classification.technologies2026-05-22
• OWASP/DockSec
  repoas tools2026-05-14

  Local scanner for image vulnerabilities and Dockerfile misconfigurations; also used as the native CycloneDX SBOM exporter; can be installed automatically by DockSec.

• The complete GitHub Actions security checklist
  articleas classification.technologies2026-05-11
• Pantheon-Security/medusa
  repoas tools2026-05-10

  External security scanning tool used in large project scans

• n8n Cybersecurity Workflows
  repoas tools2026-05-06

  Container/dependency vulnerability scanning, SBOM gating

• Tradecraft Tuesday Recap: axios npm Supply Chain Compromise
  articleas affected products2026-04-21It is written here as Trivy (Aqua Security open-source vulnerability scanner).

  Compromised by TeamPCP in March 2026, leading to downstream attacks and spread to npm ecosystem

• GitHub Actions Security Pt 1: Attacks & Defenses | Wiz Blog
  articleas affected products2026-04-14

  Supply chain breached via pull_request_target workflow misconfiguration; setup-go action code replaced

• cks/tasks/cks/course/README.md at master · ViktorUJ/cks
  courseas toolsIt is written here as Trivy (course practical tool, image scanning).

  course practical tool, image scanning

• SubQuery npm package (@subql/common) compromised with credential-stealing payload
  articleas affected productsIt is written here as Trivy (GitHub Action).

  GitHub Action compromised in March using the same imposter commit technique, cited as a precursor to this wave.

• 0x4m4/hexstrike-ai
  repoas tools

  Vulnerability scanner for containers and IaC