The TeamPCP Attack: How One Stolen Token Compromised Trivy, LiteLLM, and 47 npm Packages — What Every Developer Must Do Now

A single stolen automation token let the TeamPCP threat actor inject malicious code into Trivy, LiteLLM, and 47 npm packages in under 72 hours. Here is the full timeline, how to...

https://wowhow.cloud/blogs/teampcp-supply-chain-attack-trivy-litellm-npm-2026

#wowhow #supplychainattack #teampcp #trivy

This Week in Security: Second Verse, Worse Than the First

https://fed.brid.gy/r/https://hackaday.com/2026/03/27/this-week-in-security-second-verse-worse-than-the-first/

⚠️📢 Version 1.0: Der Open-Source-Schwachstellenscanner #Trivy von Aqua Security ist seit dem 19.03.2026 von einem Supply-Chain-Angriff betroffen, der zu Kompromittierungen in Deutschland führt.

❗️ Sollte ein Download von Versionen/Actions in diesem Zeitraum stattgefunden haben, sollte von einer Kompromittierung ausgegangen werden. Alle in diesen Runner-Umgebungen zugänglichen Geheimnisse müssen als abgeflossen angesehen werden.

Mehr Informationen findet ihr hier: 👉️ https://www.bsi.bund.de/dok/1195584

Guidance for detecting, investigating, and defending against the Trivy supplychain compromise - https://www.redpacketsecurity.com/guidance-for-detecting-investigating-and-defending-against-the-trivy-supplychain-compromise/

#threatintel
#trivy
#supply chain attack
#github actions
#ci/cd security
#credential theft

At the risk of spilling the beans too early... I grew tired of the constant barrage of supply-chain attacks afflicting the open-source community and decided to create a new open-source #malware scanner, named #Litmus.

This is part of a larger vision for intercepting supply-chain attacks, called The #Atomdrift Project. I want to empower everyone, from software marketplaces to teenagers at home, to catch the sorts of attacks we've recently seen against #Trivy and #OpenClaw.

＞2026年3月Trivyサプライチェーン攻撃とDockerイメージのバージョンピニング #trivy #docker #security - Tech Blog｜クリエーションライン
https://www.creationline.com/tech-blog/cloudnative/docker/83207

とりあえず latest バージョンを使っておけばいいか，という長閑な時代は終わったということやね。またひとつパンドラの匣を開けてしまったのか

このレベルで攻撃されるのか・・インターネッツは「性善説って何？」って感じの治安になりつつあるな。

2026年3月Trivyサプライチェーン攻撃とDockerイメージのバージョンピニング #trivy #docker #security - Tech Blog｜クリエーションライン
https://www.creationline.com/tech-blog/cloudnative/docker/83207