Malware e strumenti · Supply chain

Attori malintenzionati backdoorano Trivy Actions e rubano segreti CI/CD

Gli attori malintenzionati hanno compromesso Trivy e le GitHub Actions ufficiali di Aqua Security. Il payload eseguito nei runner GitHub Actions ruba token GitHub/PAT, credenziali cloud, SSH key, Docker e Kubernetes token e li invia a server controllati dagli attaccanti.

11 fonti · 27 mar

Cronologia

• 27 mar Segnalato da Semgrep Blog
• 25 mar Segnalato da SecurityWeek
• 24 mar Segnalato da Dark Reading
• 24 mar Segnalato da BleepingComputer
• 21 mar Segnalato da CSO Online
• 20 mar Segnalato da Ars Technica Security

Fonti

• 27 mar Semgrep Blog

  Hackers Supply Chain Attack Moves From npm to PyPI as Trivy Breach Extends into LiteLLM Package

  Analysis of the TeamPCP supply chain attack linking Trivy, GitHub Actions, npm, and LiteLLM, including how the credential stealer works and what defenders should do next.

  originale

• 25 mar SecurityWeek

  From Trivy to Broad OSS Compromise: TeamPCP Hits Docker Hub, VS Code, PyPI

  The hackers compromised GitHub Action tags, then shifted to NPM, Docker Hub, VS Code, and PyPI, and teamed with Lapsus$.

  originale

• 25 mar Microsoft Security Blog

  Guidance for detecting, investigating, and defending against the Trivy supply chain compromise | Microsoft Security Blog

  This analysis walks through the Trivy supply‑chain compromise, attacker techniques, and concrete steps security teams can take to detect and defend against similar attacks.

  originale

Part of the PlainSec briefing for 2026-03-22

Every edition of this story: Attori malintenzionati backdoorano Trivy Actions e rubano segreti CI/CD