The Trivy Supply Chain Attack: How a Compromised Security Scanner Stole Crypto Keys — And the CI/CD Hardening Playbook for DeFi Teams

The Trivy Supply Chain Attack: How a Compromised Security Scanner Stole Crypto Keys — And the CI/CD Hardening Playbook for DeFi Teams Your vulnerability scanner just became the vulnerability. Here's what happened, why crypto projects are uniquely at risk, and 7 concrete defenses you can implement today. On March 19, 2026, Aqua Security's Trivy — the most popular open-source vulnerability scanner in the cloud-native ecosystem, used by over 12,000 public repositories — was compromised for the second time in three weeks. The attacker injected credential-stealing malware into official GitHub Actions, Docker images, and binary releases. The malware specifically searched for Solana wallet credentials and crypto RPC authentication tokens alongside cloud credentials. Microsoft's Defender team confirmed the full attack chain. StepSecurity detected it through anomalous outbound connections. And every CI/CD pipeline that ran trivy-action during the 12-hour window executed the attacker's code whil