Trivy
aquasecurity/trivyReviewed by AI
What it does
Trivy is a security scanner you use by typing commands. It checks container images, folders of code, Git repositories, virtual machine images and Kubernetes clusters for known vulnerabilities, risky configuration, exposed secrets such as passwords or keys, and software licenses, and it can list every component inside (an SBOM). It is for developers and IT or security teams. Windows, Mac and Linux all get a ready program with nothing else to install. It is made by Aqua Security, which also sells a paid platform built on it.
How easy it is to install
B · installer plus one simple step · Windows
- Windows B
- macOS B
- Linux B
On Windows the release is a ready program in a zip (trivy_0.76.1_windows-64bit.zip) with no other tools to install, but you unzip it and use it by typing commands in a terminal. Mac and Linux are the same idea, with .deb and .rpm packages on Linux.
Numbers on GitHub
- Stars
- 38,882on Oct 31, 2026
- Downloads
- 61,440,0462,635,024 this week
- Growth
- +137stars in 5 days
Stars over time
Facts
- Runs on
- Windows, macOS, Linux
- You need to install
- Nothing extra
- To build from source
- Docker, Go
- Disk space
- 51 MB–154 MB · from the installer
- Accounts or keys
- None
- Cost
- Free · Free (Apache-2.0). Aqua Security sells a commercial platform built on top of Trivy; the package does not state prices.
- License
- Apache-2.0 (Permissive)
- Can replace
- Snyk, Aqua Platform
- Last update
- Oct 30, 2026
Risk signals (3)
- Attentionpast supply chain compromise
Security incident in 2026 (reported by Wiz and Snyk): on 2026-02-28 an organization token was stolen, and on 2026-03-19 the group TeamPCP published tampered binaries in the GitHub releases, Docker Hub, GHCR and ECR, and rewrote 75 of the 76 tags of trivy-action. The maintainers have removed the malicious files. Download only versions published after the incident and check the published checksums and signatures before use.
AI review
- Infocommercial upsell in readme
README.md: "If you liked Trivy, you will love Aqua which builds on top of Trivy to provide even more enhanced capabilities for a complete security management offering."
AI review
- Infocanary builds offered
README.md: "There are canary builds ... generated with every push to the main branch. Please be aware: canary builds might have critical bugs, so they are not recommended for use in production."
AI review
Evidence is shown in its original language.
What Radar could not check
- How much data it downloads on first run and how often (scanners like this usually fetch a vulnerability database).
- Whether scanning container images on Windows needs Docker or another container tool for your case.
- How many false alarms or missed problems it reports on your own projects.
- Whether the release files you download match the published checksums and signatures.
- Whether any copies of the tampered 2026 versions are still circulating in mirrors, caches or third-party channels.