A Security Scanner Became the Weapon: How a Supply Chain Attack on Trivy Spawned a Self-Replicating Worm Across 47 npm Packages
The irony is almost too perfect. Trivy, the open-source vulnerability scanner built by Aqua Security and trusted by thousands of organizations to detect security flaws in their software supply chains, became the vector for a supply chain attack of its own. The compromise didn’t just plant malicious code in one place — it triggered a