# trivy Trivy is an all-in-one security scanner that detects vulnerabilities and misconfigurations across code repositories, binary artifacts, container images, and Kubernetes clusters. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Cyber resiliency in practice: Lessons from recent supply chain attacks DevFeed: [Cyber resiliency in practice: Lessons from recent supply chain attacks]() Original publisher: [Read original article]() Published: 2026-05-08T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [resiliency](), [supply chain attacks](), [supply-chain-security](), [axios](), [GitHub Actions](), [litellm](), [trivy](), [npm](), [PyPI](), [Python](), [Large Language Model]() Tags: [axios](), [chainguard-libraries](), [cyber-resiliency](), [cybersecurity](), [github-actions](), [litellm](), [malware](), [npm](), [pypi](), [python](), [security](), [security-attacks](), [social-engineering](), [software-supply-chain-security](), [supply-chain-attacks](), [trivy](), [worm]() ### AI overview The article defines cyber resiliency as an integrated ability to anticipate, withstand, recover from, and adapt to attacks across the full Protect, Detect, Respond, and Recover lifecycle. It examines recent supply chain attacks involving Trivy, Axios, and LiteLLM, highlighting risks such as GitHub Actions misconfiguration, long-lived tokens, incomplete credential rotation, mutable Git tags, maintainer-account compromise, and malicious package releases. ### Source excerpt Learn how modern cyber resiliency helps organizations prevent, detect, and recover from supply chain attacks like Trivy, Axios, and LiteLLM. ## Secure-by-default: Chainguard customers unaffected by the Trivy supply chain attack DevFeed: [Secure-by-default: Chainguard customers unaffected by the Trivy supply chain attack]() Original publisher: [Read original article]() Published: 2026-03-20T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [supply-chain-security](), [trivy](), [chainguard](), [incident](), [Security](), [CI/CD](), [Open Source]() Tags: [chainguard](), [ci-cd](), [incident](), [secure-by-default](), [security](), [supply-chain](), [supply-chain-security](), [trivy](), [vulnerability]() ### AI overview Chainguard reports that its customers were unaffected by the March 19, 2026 supply chain attack involving malicious releases of the Trivy vulnerability scanner, trivy-action, and setup-trivy. The article explains how compromised credentials enabled the releases, why the incident threatened CI/CD pipeline secrets, and what organizations using the affected versions should do. ### Source excerpt Chainguard customers are unaffected by the Trivy supply chain attack. ## Software Bill of Materials (SBOM) for your Spin Apps DevFeed: [Software Bill of Materials (SBOM) for your Spin Apps]() Original publisher: [Read original article]() Author: Thorsten Hans Published: 2025-01-16T12:00:00Z Content type: tutorial Language: en Sources: [Fermyon - Experience the next wave of cloud computing.]() Topics: [software bill of materials](), [supply-chain-security](), [trivy](), [Open Source](), [Requirements](), [Software]() Tags: [open-source](), [regulatory](), [sbom](), [software-bill-of-materials](), [software-supply-chain](), [supply-chain](), [trivy]() ### AI overview A tutorial on creating Software Bills of Materials for Spin apps, addressing regulatory requirements and software supply chain security with open-source tools such as Trivy. ### Source excerpt Learn how to create SBOMs for Spin apps, meet regulatory requirements, and secure your software supply chain with open-source tools like Trivy ## Can auto-patched container images pass the zero CVE challenge? DevFeed: [Can auto-patched container images pass the zero CVE challenge?]() Original publisher: [Read original article]() Published: 2024-07-17T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [container images](), [Vulnerabilities](), [chainguard images](), [grype](), [trivy](), [Security](), [Open Source]() Tags: [chainguard](), [chainguard-images](), [container](), [container-images](), [grype](), [security](), [trivy](), [vulnerabilities]() ### AI overview This article examines whether auto-patching can reduce vulnerabilities in container images. An experiment involving 20 popular images found that copacetic reduced CVEs by an average of 8%, while manually updating packages reduced them by 9%. Chainguard Images reduced CVEs by 99% in the reported comparison. ### Source excerpt Discover how Chainguard surpasses copacetic in the zero-CVE challenge. Ensure vulnerability-free deployments with our Chainguard Images. ## The haunting of CVE-2022-3474: A ghostly tale of package detection failure DevFeed: [The haunting of CVE-2022-3474: A ghostly tale of package detection failure]() Original publisher: [Read original article]() Published: 2023-10-10T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [vulnerability](), [container images](), [chainguard images](), [vulnerability management](), [bazel](), [trivy]() Tags: [bazel](), [chainguard-images](), [container-images](), [cve-2022-3474](), [false-negative](), [trivy](), [vulnerability-management]() ### AI overview The article explains how scanners can produce false negatives when they fail to identify a package in a container image. Using CVE-2022-3474 in Bazel 5.3.1 as an example, it describes how missing Bazel package metadata prevented Trivy from detecting the vulnerability and presents Chainguard Images' package metadata and SBOMs as a way to improve detection. ### Source excerpt Explore the risks of scanner false negatives, the pitfalls of missing the Bazel package, and how Chainguard Images ensure accurate vulnerability detection. ## How a false negative obscured CVE-2023-2454 in a PostgreSQL image DevFeed: [How a false negative obscured CVE-2023-2454 in a PostgreSQL image]() Original publisher: [Read original article]() Published: 2023-10-03T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [container-security](), [Vulnerabilities](), [chainguard images](), [trivy](), [PostgreSQL]() Tags: [chainguard-images](), [container-security](), [cve-2023-2454](), [false-negative](), [postgresql](), [trivy](), [vulnerability](), [vulnerability-scanner](), [vulnerability-scanning]() ### AI overview The article explains how insufficient vulnerability database metadata can cause a scanner to miss CVE-2023-2454 in a PostgreSQL image. It presents Chainguard Images as often containing fixes for vulnerabilities that scanners miss. ### Source excerpt Unearth a haunting tale of overlooked threats in scanning. Discover how Chainguard Images counteract gaps, ensuring robust defense against CVEs. ## A growing ecosystem of vulnerability scanners that now support Chainguard Images and Wolfi DevFeed: [A growing ecosystem of vulnerability scanners that now support Chainguard Images and Wolfi]() Original publisher: [Read original article]() Published: 2023-09-21T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard images](), [Security](), [open-source-security](), [trivy](), [Monitoring](), [Open Source]() Tags: [chainguard](), [chainguard-images](), [container](), [container-images](), [cve](), [false-positives](), [grype](), [prisma-cloud](), [sca](), [scanners](), [secure-images](), [security](), [snyk](), [trivy](), [vulnerabilities](), [vulnerability](), [wiz](), [wolfi]() ### AI overview Chainguard Images and the Wolfi distribution are now supported by a growing ecosystem of open-source and enterprise vulnerability scanners, including Docker Scout, Grype, Snyk, Trivy, and Wiz. The broader integration helps users monitor and prioritize scan results, verify vulnerabilities, reduce scanner noise and false positives, and build more secure software. ### Source excerpt Secure your software with Chainguard & Wolfi, now recognized by leading vulnerability scanners.