Trivy Supply Chain - Curl Exfiltration from trivy-action

Lacey Cochrane@NullVectorX

•updated Mar 27, 2026•3•0•147

Detects `curl` commands performing `POST` requests with `--data-binary` that are spawned from a process whose command line contains "trivy-action". This behavior is indicative of potential data exfiltration in the context of a compromised Trivy supply chain.