Malicious Trivy VS Code Extension 1.8.12 Supply-Chain Compromise
CVE-2026-28353 tracks a supply-chain compromise of the Trivy Vulnerability Scanner VS Code extension. According to the provided content, Trivy VSCode Extension version 1.8.12 distributed through the OpenVSX marketplace was compromised and shipped with malicious code. The implanted code was designed to leverage a locally installed AI coding agent to inspect the developer environment, collect sensitive information, and exfiltrate that data. Supporting reporting in the provided context states the broader incident involved abuse of local AI coding CLIs such as Claude, Codex, Gemini, GitHub Copilot CLI, and Kiro, and that the malicious extension targeted developer workstations rather than production systems directly. The malicious artifact has since been removed from the marketplace, and the provided content states that no other affected artifacts were identified in the CVE record.
Are you exposed to this one?
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
Impact, mitigation & remediation
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
Impact
What an attacker gets, and what they’ve been doing with it.
Mitigation
If you can’t patch tonight, do this now.
Remediation
Patch, then assume compromise.
Exploits
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
Recent activity
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A vulnerability/incident identified as CVE-2026-28353 involving the Trivy AI-agent compromise, where stolen tokens were used to publish a weaponized VS Code extension targeting multiple AI coding agents.
A compromise of the Trivy VS Code extension that weaponized locally installed AI coding CLIs as exfiltration channels in developer environments.
A supply-chain compromise affecting Aqua Security Trivy VS Code extension releases (versions 1.8.12 and 1.8.13) distributed via Open VSX, where injected logic abuses local AI coding assistants and (in 1.8.13) the victim’s authenticated GitHub CLI session to collect system information and exfiltrate it to a GitHub repository.
A supply-chain compromise of the Trivy Vulnerability Scanner VS Code extension (v1.8.12 distributed via OpenVSX) where the published artifact contained malicious code intended to leverage a local AI coding agent to collect and exfiltrate sensitive information.
The version that knows your environment.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.