Aqua Security’s Trivy vulnerability scanner compromise is trickling down into a hugely popular Python package.