All extensions seem to have been made by a single actor, possibly of Russian origin.
Breakdown of the Trivy GitHub Actions attack, including workflow misconfigurations, token theft, and supply chain exposure.