Trivy Supply Chain Attack: What Happened and What You Need to Know

A sophisticated supply chain attack compromised Trivy’s GitHub Actions and release automation, allowing attackers to silently inject credential-stealing malware into trusted CI/CD workflows by force-pushing malicious code to existing version tags, potentially exposing sensitive secrets across countless downstream environments.