Trivy
AssessTools
An open-source security scanner used for containers, dependencies, and infrastructure artifacts.
Why it's here
Placed in Assess: 2 article(s) of evidence from 1 source(s), led by security coverage, with 1 in the last 30 days. Confidence 37%.
Evidence (2)
- 8The New Stack·9/23/2026securityAI is reshaping software supply chain security
AI coding tools are accelerating both software development and attacker workflows, making the software supply chain a growing security battleground. The article highlights how AI agents can choose dependencies, chain lower-severity flaws into viable attacks, and intensify threats to open-source ecosystems and vulnerability management.
- 8The New Stack·7/1/2026securityCordyceps flaw shows CI/CD is part of the attack surface
Research from Novee Security describes the “Cordyceps” CI/CD weakness, which could let unauthenticated GitHub accounts hijack trusted workflows and compromise open-source supply chains. The report says it found hundreds of potentially exploitable repositories, reinforcing that CI/CD pipelines should be treated as security-critical production systems rather than mere configuration.