Malware & Tooling · Supply Chain
Aqua Security's Trivy GitHub Actions repositories were force-pushed and 75 tags replaced with malicious versions. The injected payload ran in GitHub Actions runners and exfiltrated CI/CD and developer secrets.
11 sources · Mar 25
SecurityWeek
From Trivy to Broad OSS Compromise: TeamPCP Hits Docker Hub, VS Code, PyPI
The hackers compromised GitHub Action tags, then shifted to NPM, Docker Hub, VS Code, and PyPI, and teamed with Lapsus$.
originalMicrosoft Security Blog
Guidance for detecting, investigating, and defending against the Trivy supply chain compromise | Microsoft Security Blog
This analysis walks through the Trivy supply‑chain compromise, attacker techniques, and concrete steps security teams can take to detect and defend against similar attacks.
originalThe Hacker News
TeamPCP Backdoors LiteLLM Versions 1.82.7–1.82.8 via Trivy CI/CD Compromise
Malicious LiteLLM 1.82.7–1.82.8 via Trivy compromise deploys backdoor and steals credentials, enabling Kubernetes-wide persistence and lateral spread.
originalPart of the PlainSec briefing for 2026-03-27
Every edition of this story: Trivy GitHub Actions Compromise Exposes CI/CD Secrets