A recent supply chain attack targeted Aqua's Trivy vulnerability scanner, resulting in the publication of a malicious scanner release. The attackers replaced tags to redirect users to information-stealer malware, potentially compromising the security of systems that rely on Trivy for vulnerability detection. This incident highlights the risks associated with supply chain attacks, where attackers exploit vulnerabilities in third-party components to gain access to sensitive systems. The malicious release was made available to users, who may have unknowingly downloaded the compromised scanner, putting their systems at risk of infection with information-stealing malware1. The attack on Trivy, a widely used open-source vulnerability scanner, underscores the importance of verifying the integrity of software releases and updates. So what matters to practitioners is that they must be vigilant in monitoring their systems for signs of compromise and ensure that all software components are thoroughly vetted to prevent similar attacks.