@codacy/tools-trivy-0

Table of Contents

• Overview
• Umbrella patterns
• DB update management
• Malicious package detection
• Updating patterns
• Updating the Trivy version
• Development
• Notes for maintainers

Overview

Security scanner using the Trivy binary. Scans for vulnerabilities in dependencies and hardcoded secrets. Uses the CLI execution strategy with two separate scan modes (vulnerability + secret).

| Property | Value | | ------------- | ------------------------------------------- | | Tool ID | Trivy | | Codacy UUID | 2fd7fbe0-33f9-4ab3-ab73-e9b62404e2cb | | Strategy | CLI | | Languages | Multi-language (scans dependency manifests) | | Binary | trivy | | File patterns | * (auto-detects dependency manifests) | | Pattern count | 6 (umbrella patterns) |

Umbrella patterns

Trivy uses umbrella patterns rather than individual CVE patterns:

| Pattern ID | Severity | Description | | ------------------------------ | -------- | ------------------------------------ | | Trivy_vulnerability_critical | Error | Critical vulnerabilities | | Trivy_vulnerability_high | High | High-severity vulnerabilities | | Trivy_vulnerability_medium | Warning | Medium-severity vulnerabilities | | Trivy_vulnerability_minor | Info | Low-severity vulnerabilities | | Trivy_secret | Error | Hardcoded secrets | | Trivy_malicious_packages | Error | Malicious packages (via OSV.dev API) |

DB update management

The adapter reads Trivy's metadata.json (at {cacheDir}/db/metadata.json) to determine if the vulnerability database is still fresh. The NextUpdate field tells us when Trivy expects the next DB update.

| Scenario | Behavior | | ------------------------------ | ------------------------------------------------------------------ | | DB fresh (now < NextUpdate) | --skip-db-update --skip-java-db-update passed — no network check | | DB stale (now >= NextUpdate) | Trivy checks for updates normally | | First run (no metadata) | Trivy downloads the DB (~40MB) | | Container mode | Always skips DB updates (DBs are pre-baked) |

Malicious package detection

Detects known malicious packages by querying the OSV.dev batch API. This piggybacks on the vulnerability scan output — the package list from --list-all-pkgs is extracted and cross-referenced against the OpenSSF malicious packages index (MAL-* IDs).

• Covers 14 ecosystems: npm, PyPI, Go, RubyGems, crates.io, NuGet, Maven, Packagist, Pub, Hex, ConanCenter, CocoaPods, SwiftURL, conda
• Uses a 10-second timeout per API call
• On API failure (network error, timeout), logs a warning and skips — never blocks the core scan
• Message format: Malicious package detected: {name}@{version} ({MAL-ID}). {summary}

Updating patterns

# Re-fetch pattern metadata from the Codacy API
pnpm prefetch

# Commit the result
git add src/patterns.json

Updating the Trivy version

1. Update preferredVersion in src/adapter.ts
2. Update the download URL template if the release format changed
3. Run pnpm test to verify compatibility

Development

pnpm build    # Build with tsup
pnpm test     # Run tests (requires trivy in PATH or auto-install)

Notes for maintainers

• Trivy runs two separate scan invocations: one for vulnerabilities (--scanners vuln) and one for secrets (--scanners secret). Malicious package detection piggybacks on the vuln scan output (no extra invocation). Which scans run depends on which umbrella patterns are enabled.
• The vulnerability database is downloaded lazily on first run to --cache-dir ~/.codacy/cache/trivy/. Internet access is required on first use. DB staleness is managed via metadata.json → NextUpdate.
• Trivy scans whole directories, not individual files. Results are filtered to ctx.targetFiles after scanning.
• The binary is downloaded from GitHub releases as a .tar.gz archive.
• Vulnerability severity (CRITICAL/HIGH/MEDIUM/LOW) maps to the corresponding umbrella pattern.
• Message format: Insecure dependency {pkg}@{version} ({CVE}: {title}). Update to {fixedVersion}.
• Malicious package detection uses the OSV.dev batch API. On failure, it degrades gracefully (warning only).
• Config file: checks for trivy.yaml in the repo root.