The Trivy vulnerability scanner was compromised in a supply-chain attack by threat actors known as TeamPCP, which distributed credential-stealing malware through official releases and GitHub Actions.
Hosted on MSN
A single 'git push' could hijack millions of GitHub repositories — and nobody knew for weeks
Sometime in early 2026, a flaw hiding inside one of the most routine actions in software development went live on the world’s largest code-hosting platform. Every time a developer ran git push to send ...
Some results have been hidden because they may be inaccessible to you
Show inaccessible results