Trivy Supply Chain Compromise: What Happened, What Was Stolen, and How to Respond
A consolidated technical reference for the TeamPCP supply chain attack against Aqua Security's Trivy scanner. Covers the full attack chain from AI-assisted initial breach through credential theft…
Read the full articleYou might also wanna read
Trivy Vulnerability Scanner Compromised in Supply Chain Attack That Harvested CI/CD Credentials
Trivy v0.69.4 silently harvested credentials from thousands of CI/CD pipelines. The secrets managers didn't help. Here's why — and what does
vaultproof.dev·3mo ago
Trivy GitHub Actions Compromised in Supply Chain Attack, Exposing CI/CD Secrets
Attackers compromised Trivy GitHub Actions by force-updating tags to deliver malware, exposing CI/CD secrets across affected pipelines.
socket.dev·3mo ago
Trivy Security Tool Supply Chain Compromised by Threat Actor in March 2026
## Summary On March 19, 2026, a threat actor used compromised credentials to publish a malicious Trivy v0.69.4 release, force-push 76 of 77
github.com·3mo agoTeamPCP Supply Chain Attack: The npm Worm That Hit GitHub, OpenAI, and Mistral AI
Between May 11 and May 19, 2026, a threat actor called TeamPCP poisoned 170+ npm/PyPI packages, hijacked a VS Code extension with 2.2M insta
Security scanner compromise leads to widespread infostealer and ransomware pivot
A supply chain attack exploiting GitHub, npm, and PyPl alloA supply chain attack exploiting GitHub, npm, and PyPl allowed attackers to distr
GitHub Actions workflows identified as common weak link in open source supply chain attacks
Anne Robinson would like a word with .github/workflows
Comments
Sign in to join the conversation.
No comments yet. Be the first.