Sophisticated Supply Chain Attack Compromises Trivy GitHub Action, Exposing CI/CD Pipelines Globally In late March 2026, a high-impact supply chain attack targeted the official Trivy GitHub Action (aquasecurity/trivy-action), a widely used security scanning tool in continuous integration and continuous deployment (CI/CD) pipelines. Threat actors executed a force-push attack, compromising 75 out of 76 existing version tags to distribute a malicious infostealer designed to exfiltrate credentials. This incident is the second Trivy-related compromise in a single month, raising concerns about a potential pattern of targeted attacks. With over 10,000 GitHub workflows relying on the affected action, the breach exposes a vast number of organizations to credential theft undermining the very tool meant to secure their pipelines. The attack highlights the escalating risk of supply chain vulnerabilities in CI/CD environments, where trusted dependencies can become vectors for exploitation. Security teams are advised to prioritize strict version control, dependency validation, and continuous monitoring to mitigate similar threats. The incident underscores the need for rigorous verification of third-party tools, even those positioned as security solutions.