Timeline and IOCs for the March 2026 Trivy supply chain attack. TeamPCP compromised trivy-action and setup-trivy GitHub Actions to steal CI/CD credentials.