What is the Trivy supply chain compromise?

Attackers hijacked Aqua's CI/CD to inject malware into Trivy Docker images (0.69.4-0.69.6, latest), stealing secrets from March 19-23, 2026.

How do I check if I pulled compromised Trivy images?

Search for these SHA256 digests in your registries/caches and scan pull logs for those tags in the timeframe.

Yes, immediately if any suspect image ran, especially with Docker socket mounted — treat host as fully owned.

🗄️ Databases & Backend

Threat actors turned a popular vuln scanner into a credential thief. Docker Hub users: check your logs yesterday.

DevTools Feed Apr 03, 2026 4 min read 11 views

Published by

Ship faster. Build smarter.

#Aqua Security breach #CI/CD attack #Docker Hub security #Trivy compromise #Trivy supply chain compromise #container malware #supply chain attack

Get the best Developer Tools stories of the week in your inbox — no noise, no spam.

Originally reported by Docker Blog