Widely used Trivy scanner compromised in ongoing supply-chain attack

Aqua Security's Trivy vulnerability scanner was compromised in an active supply chain attack, with hackers using stolen credentials to force-push malicious code into 75+ trivy-action and setup-trivy tags. The malware silently exfiltrates pipeline secrets — GitHub tokens, cloud credentials, SSH keys, Kubernetes tokens — encrypts them, and sends to attacker-controlled servers. Any developer or org running affected pipeline versions should treat all pipeline secrets as compromised and rotate immediately.