Guidance for detecting, investigating, and defending against the Trivy supply chain compromise

Microsoft analyzes a Trivy software‑supply‑chain compromise in which threat actors abused trusted Trivy distribution channels to push credential‑stealing malware into CI/CD pipelines globally. The writeup describes attacker techniques (tampering with distribution/artifacts to deliver malicious binaries), the resulting impact (credential theft and pipeline compromise), and concrete detection, investigation, and mitigation guidance for security teams—e.g., verifying package integrity, monitoring pipeline artifacts and build hosts, rotating/isolating credentials, tightening egress controls, and m