AIKIDO-2026-10897

TL;DR

Affected versions of Trivy were compromised in a supply chain attack where attackers published malicious releases and force-pushed tags to credential-stealing malware. The malicious payloads were capable of extracting secrets, SSH keys, cloud credentials, tokens, and other sensitive data from CI/CD environments and exfiltrating them to attacker-controlled infrastructure. Downgrading Trivy to version 0.69.3 is considered a safe mitigation.