Attackers compromised the Trivy GitHub Actions integration by force-updating tags to point to malicious code, enabling malware delivery and CI/CD secret exfiltration across affected pipelines. This is a supply chain attack targeting the popular security scanning tool's GitHub Actions tags, putting any workflow using those tags Show more