How Attackers Turned Trivy Into a Weapon Against Cisco

Cisco DevHub, ShinyHunters, and the Artifact Store Problem This is not a supply chain attack on Trivy. Trivy's code was not compromised. Its release pipeline was not tampered with. Its distribution chain was not poisoned. The attack class is artifact store misconfiguration - an access control failure in how CI/CD scan output was stored and exposed. No Trivy CVE is confirmed as the attack vector. This is a configuration failure, not a software vulnerability. The remediation path is access control