Trivy Supply Chain Attack: What Happened and What You Need to Know (opens in new tab)

Open Source Security Advisory What Happened On March 19, 2026, a threat actor used compromised credentials to publish malicious releases of Trivy version 0.69.4, along with trivy-action and setup-trivy. While this activity initially appeared to be an isolated event, it was the result of a broader, multi-stage supply chain attack that began weeks earlier. Attack …