#trivy supply chain attack spreads to #dockerhub. Compromised Docker Hub images and a self-propagating npm worm have been discovered, escalating the Trivy breach into a multi-platform threat. Stolen npm tokens from infected CI/CD pipelines fueled a self-propagating worm dubbed #CanisterWorm, compromising nearly 50 npm packages across multiple scopes.
https://thehackernews.com/2026/03/trivy-security-scanner-github-actions.html?m=1









