Trivy only do a CVE / package version mapping. It will not tell you you are using a malicious package from an unknown repo because of typosquatting or bad practices.