2 ms·
You may look into Trivy [0] , works very well for me so far. [0] https://trivy.dev/ https://trivy.dev/
by alentred 3y ago
You may look into Trivy [0] , works very well for me so far.
[0] https://trivy.dev/ https://trivy.dev/
- richbell 3y agoAs far as I know, Trivy only flags known vulnerabilities and would not protect against supply-chain attacks like this.
- prmoustache 3y agoTrivy only do a CVE / package version mapping. It will not tell you you are using a malicious package from an unknown repo because of typosquatting or bad practices.