Here's a bit more a technical security research write up on how the compromise was introduced into the Trivy ecosystem: https://rosesecurity.dev/2026/03/20/typosquatting-trivy.html

What are the trivy alternatives for terraform code

I've only mainly used Checkov but the alternatives are slim