Adam Cardillo - Ben Ellett - Travis Lowe - Radu-Emanuel Chiscariu

From Scanner to Stealer: Inside the trivy-action Supply Chain Compromise

From Scanner to Stealer: Inside the trivy-action Supply Chain Compromise

March 20, 2026

Adam Cardillo - Ben Ellett - Travis Lowe - Radu-Emanuel Chiscariu From The Front Lines

While investigating a spike in script execution detections across several CrowdStrike Falcon® platform customers, CrowdStrike’s Engineering team traced the activity to a compromised GitHub Action name[…]

    Created with Sketch.
    See CrowdStrike Falcon® in Action

    Detect, prevent, and respond to attacks— even malware-free intrusions—at any stage, with next-generation endpoint protection.

    See Demo