Trivy ecosystem supply chain was briefly compromised in github.com/aquasecurity/trivy
On March 19, 2026, a threat actor used compromised credentials to publish a malicious Trivy v0.69.4 release.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-33634US | high8.8OT critical | KEV | ||
Trivy is a security scanner. On March 19, 2026, a threat actor used compromised credentials to publish a malicious Trivy v0.69.4 release, force-push 76 of 77 version tags in `aquas… | ||||
02
references
External citations — patches, advisories, analysis.
- https://docs.litellm.ai/blog/security-update-march-2026WEB
- https://futuresearch.ai/blog/litellm-pypi-supply-chain-attackWEB
- https://github.com/BerriAI/litellm/issues/24518WEB
- https://github.com/BerriAI/litellm/issues/24518#issuecomment-4127436387WEB
- https://github.com/aquasecurity/trivy/discussions/10425WEB
- https://github.com/aquasecurity/trivy/security/advisories/GHSA-69fq-xp46-6x23ADVISORY
- https://github.com/pypa/advisory-database/tree/main/vulns/litellm/PYSEC-2026-2.yamlWEB
- https://github.com/team-telnyx/telnyx-python/security/advisories/GHSA-955r-262c-33jcWEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan