Widely used Trivy scanner compromised in ongoing supply-chain attack
2026-03-22T08:51:44Z•a85647e6fc97aa4748b6d5ec327a6d6ea6ded9486b4044cc9feafd863f827271
airsnitchasusbackdoored-updatesbotnetcastleloadercertificates-expiry','patch-management','vulnerability-discoverycisacrypto-theftdarkSworddydxfirmwareinvisible-unicodeiosip-kvmlumma-stealermalicious-packagesnotepad++routerssecure-bootsoftware-supply-chainstrykersupply-chaintrivywifiwiper
What happened
This Ars Technica security feed (Feb–Mar 2026) aggregates multiple high-impact incidents: a supply‑chain compromise of the widely used Trivy scanner, invisible‑Unicode supply‑chain attacks on code repositories, backdoored update infrastructure (Notepad++), malicious packages targeting dYdX wallets, and resurgence of Lumma Stealer. It also highlights large-scale device/firmware threats (14,000 Asus routers infected; IP‑KVM vulnerabilities giving BIOS‑level access), in‑the‑wild iPhone exploit tooling (DarkSword) added to CISA’s known‑exploited list, a destructive wiper incident against Stryker,
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- arstechnica_security
- Record identifier
- a85647e6fc97aa4748b6d5ec327a6d6ea6ded9486b4044cc9feafd863f827271
- Enrichment time
- 2026-03-22T08:51:44Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.