Widely used Trivy scanner compromised in ongoing supply-chain attack
2026-03-21T20:51:53Z•5f5c470f21d771c196473864b844b05315064aadc500eda7f2f76e754a6ca80c
AirSnitchDarkSwordbackdoorbotnetcredential-exposureincident-responseios-exploitip-kvmlumma-stealermalicious-packagespatchingrouter-malwaresoftware-supply-chainsupply-chaintrivyunicode-supply-chainwifi-exploitwiper
What happened
A cluster of active, high-impact incidents and research was reported: a supply‑chain compromise of the widely used Trivy scanner (credential/secret exposure risk) and multiple other supply‑chain/backdooring campaigns (invisible Unicode, Notepad++ updates, malicious dYdX packages); a powerful iPhone exploit toolkit (DarkSword) observed in the wild; internet‑exposed IP‑KVM vulnerabilities providing BIOS‑level access; ~14,000 consumer routers persistently infected; a destructive wiper outage at Stryker; and a new Wi‑Fi attack (AirSnitch) that defeats common encryption setups. The pattern shows a重
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- arstechnica_security
- Record identifier
- 5f5c470f21d771c196473864b844b05315064aadc500eda7f2f76e754a6ca80c
- Enrichment time
- 2026-03-21T20:51:53Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.