It's both. They got compromised by another supply chain attack on Trivy initially.