Widely used Trivy scanner compromised in ongoing supply-chain attack

Hackers compromised virtually all versions of Aqua Security's Trivy vulnerability scanner through a supply chain attack beginning Thursday, with maintainer Itay Shakury confirming the breach on Friday. The attackers used stolen credentials to force-push malicious dependencies into trivy-action and setup-trivy tags, overriding git safety mechanisms that normally prevent such overwrites. Trivy, a tool with 33,200 GitHub stars that developers use to detect vulnerabilities and hardcoded secrets in software pipelines, is now suspected of being compromised across those pipelines. The threat actor's altered code could affect any organization using the scanner to vet their own software deployments, potentially exposing multiple development environments downstream.