GoKawiilWhat happened
The anatomy of the attack
On March 19, 2026, Aqua Security's Trivy — one of the most widely used vulnerability scanners in the world — was compromised. Attackers injected credential-harvesting logic directly into the official release binary.
The payload was sophisticated: scans appeared to complete and pass normally. The credential exfiltration ran silently alongside legitimate functionality. Teams had no indication anything was wrong.
The attack didn't need to find a vulnerability in your code. It exploited the fact that your CI/CD pipeline runs tools with access to your environment — and your API keys live in that environment as plaintext strings.
This is the supply chain attack model that makes traditional secrets management insufficient: if the key exists as a plaintext string anywhere in your runtime environment, a compromised tool can find and exfiltrate it.