Widely used Trivy scanner compromised in ongoing supply-chain attack

Hackers have compromised nearly all versions of Aqua Security's Trivy vulnerability scanner in an active supply chain attack. Using stolen credentials, attackers force-pushed malicious dependencies into 75 trivy-action tags and 7 setup-trivy tags. The malware scours CI/CD pipelines for GitHub tokens, cloud credentials, SSH Show more