Trivy Supply Chain Compromise via Malicious Docker Images (infosecurity-magazine.com)

• Compromise detected in official-looking 0.69.5 and 0.69.6 images.
• TeamPCP infostealer payload embedded to target secrets.
• Impacts automated security scanning workflows globally.

"Trivy Docker images (versions 0.69.5 and 0.69.6) have been compromised with the TeamPCP infostealer. This attack targets the CI/CD scanning process, weaponizing a security tool to exfiltrate credentials. It highlights critical vulnerabilities in automated software delivery pipelines that rely on third-party image registries."