Package
trivy-fips
Component
github.com/aquasecurity/trivy
Latest update
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Justification
Impact
Only trivy v0.69.4 contains the malicious code from the supply-chain compromise. GHSA-69fq-xp46-6x23 lists the affected Go module version as exactly "= 0.69.4", and the attempted malicious v0.70.0 release was stopped before its tag was pushed and never reached the source tree. This package builds trivy v0.70.0 from the clean upstream git tag, so it does not include the vulnerable version. The match originates from the Go vulnerability database record GO-2026-4919, whose SEMVER range encodes {introduced: 0.69.4} with no fixed/last_affected bound, incorrectly flagging every version >= 0.69.4.
Status