All articles tagged with #trivy
Australian Federal Police arrested two men linked to TeamPCP for a nine‑month, global supply‑chain campaign that infected over 1,000 organizations by compromising CI/CD pipelines and downstream packages like Trivy; the suspects face multiple charges and potentially decades in prison if convicted, with investigators noting credential theft and a canister-based mechanism helping the malware persist.
The Trivy vulnerability scanner was compromised in a supply-chain attack by threat actors TeamPCP, who backdoored the Trivy GitHub build process and trojanized releases and related GitHub Actions (notably v0.69.4). This allowed an infostealer to harvest credentials and other secrets from GitHub Actions runners, CI configs, and local developer environments, exfiltrating data to a typosquatted C2 server or via a public repo. Attackers gained write access to publish malicious releases and force-push most tags, making detection difficult; Aqua Security linked the breach to an earlier credential exfiltration and noted token rotation wasn't atomic. The incident is connected to a follow-up CanisterWorm npm campaign by the same actor. Remediation includes rotating all secrets, auditing for compromise, and investigating for persistence across environments.