Daylight Highlights Credential Theft Risks From Compromised CI/CD Security Tool

According to a recent LinkedIn post from Daylight, the company’s security team has been tracking what it describes as a severe compromise of the Trivy security scanner, specifically version 0.69.4 used in CI/CD pipelines. The post characterizes the incident not only as a supply chain issue but as a credential-harvesting operation with access to a broad range of sensitive secrets.

The post indicates that Daylight detected the malicious release early and began hunting for indicators across client environments, suggesting an active incident response capability. It further claims that the altered Trivy release and a related GitHub Action systematically target SSH keys, cloud credentials across AWS, GCP, and Azure, Kubernetes configurations, environment files, and various access tokens and database credentials.

According to the description, the suspected exfiltration path involves a domain resembling Aqua Security infrastructure as well as a fallback mechanism that creates public GitHub repositories to store stolen data. The LinkedIn content warns that any CI runner that executed the compromised version should be treated as if all accessible credentials were exposed, reframing the event as an identity compromise rather than a localized runner issue.

For investors, the post suggests that Daylight is positioning itself as a specialist in detecting and responding to complex software supply chain and CI/CD identity threats. If the analysis proves accurate and is widely recognized by enterprises, this could enhance Daylight’s credibility and drive demand for its threat-hunting and monitoring solutions in a growing DevSecOps and cloud security market.

The incident, as described, underscores escalating risks in software supply chains and automated build environments, potentially increasing security budgets and prioritization for tools that monitor CI/CD pipelines. Daylight’s visible involvement in analyzing a high-profile security issue may strengthen its competitive standing versus other application and cloud security vendors, although the financial impact will depend on customer conversions and the broader industry response.