Trivy Tag Compromise Supply Chain Attack

Trivy's release process was compromised when attackers reassigned the v0.69.4 Git tag to malicious commits and published a release containing binaries that collect environment variables, configuration data, and CI secrets and exfiltrate them to attacker infrastructure; this active supply-chain attack can propagate broadly via automated CI/CD and developer workflows, and recommended mitigations include avoiding unverified tags, pinning commit SHAs, enforcing tag/release protections, rotating exposed secrets, and validating releases via checksums or cryptographic signatures.