The Trivy story is moving quickly, and the latest reporting makes one thing clear: this is no longer just a GitHub Actions tag hijack. What started as a compromise of trivy-action, setup-trivy, and the v0.69.4 release has expanded into malicious Docker Hub images.

The post Trivy’s March Supply Chain Attack Shows Where Secret Exposure Hurts Most appeared first on Security Boulevard.

Guillaume Valadon

Source: Security Boulevard
Source Link: https://securityboulevard.com/2026/03/trivys-march-supply-chain-attack-shows-where-secret-exposure-hurts-most/