Recent software supply chain attacks - yowers!

In March, popular open source tools Trivy and Axios were compromised with malware, and we won't know the full blast radius for months.

Axios was breached by North Korean hackers who turned it into a malware delivery vehicle for about three hours after attackers hijacked a maintainer's account and slipped a remote-access trojan (RAT) into two seemingly legitimate releases.

Trivy was hacked by a loosely knit band of hackers called TeamPCP, who injected credential-stealing malware.

"Attackers are starting to really look at the supply chain and open source packages, and figure out ways to compromise developers to deliver malware or gather data" ... https://www.theregister.com/2026/04/11/trivy_axios_supply_chain_attacks/ #Hackers #Malware #Software #OpenSource #SoftwareSupplyChain #Trojan #CyberSecurity #Security #Trivy #Axios

https://www.theregister.com/2026/04/11/trivy_axios_supply_chain_attacks/ #trivy

"TeamPCP compromised Trivy, an open source vulnerability scanner maintained by Aqua Security in late February, then injected credential-stealing malware into the scanner on March 16 through the binary, GitHub Actions, and container images. This malware hoovered up CI/CD secrets, cloud credentials, SSH keys, and Kubernetes configuration files, and planted persistent backdoors on developers' machines. It also gave the attacks an initial access vector into several other open source tools.

Then, on March 23, the same crew used CI/CD secrets stolen from the Trivy intrusion to inject the same malware into open source static analysis tool KICS, maintained by Checkmarx. Days later, TeamPCP published malicious versions of LiteLLM and Telnyx to the Python Package Index (PyPI), both of which use Trivy in their CI/CD pipeline."

[Перевод] Отчёт PSF об инциденте атаки на цепочку поставок LiteLLM/Telnyx + рекомендации

В этой статье рассмотрены две недавние атаки на цепочку поставок, направленные на пользователей популярных пакетов PyPI — litellm и telnyx. Также описаны рекомендации разработчикам и сопровождающим Python о том как подготовиться и защитить свои проекты.

https://habr.com/ru/articles/1019638/

#pypi #litellm #telnyx #security #атака_на_цепочку_поставок #best_practices #безопасность #python #trusted_publishers #trivy

🚨 Over the past two weeks, two massive, overlapping campaigns—TeamPCP’s "blitzkrieg" on security tools like Trivy and Checkmarx, and UNC1069's devastating RAT deployment via the Axios library—have compromised thousands of CI/CD pipelines.

Read the full deep-dive and get the immediate mitigation steps here: https://www.security.land/2026-supply-chain-attacks-teampcp-trivy-axios/

#SecurityLand #BreachBreakdown #SupplyChainAttack #NPM #Cybersecurity #Axios #Trivy #TeamPCP #UNC1069

RE: https://fosstodon.org/@pypi/116335453780319113

rapport d'incident par @miketheman & @sethmlarson sur la corruption de #liteLLM & #Telnyx via #Trivy : https://blog.pypi.org/posts/2026-04-02-incident-report-litellm-telnyx-supply-chain-attack/

Conseils :
- délai de précaution dans la montée de version des dépendances
-- pip.conf
[install]
uploaded-prior-to = P3D
-- uv.toml / pyproject.toml
[tool.uv]
exclude-newer = "P3D"
- utiliser un lockfile pour les dépendances transitives
- publication : par le trusted publishing, surveiller les PR touchant aux workflows de CI

#Python #PyPI #cybersécurité #supplychain

A useful reminder from the last few days, I think: security tooling is part of the attack surface - maybe that aren't news.

But: If scanners, GitHub Actions or container images get compromised, this is not just a supply chain problem on paper. It hits the exact layer we **usually** trust to keep the rest safe.

Feels like a good time to ask: where are we still too loose on pinning, still trusting `latest`, or still assuming third-party actions are probably fine?

I think we need to find the right balance between `latest` and waiting days or even weeks to update a component (especially if it's an security patch).

#axios #trivy #supplychain #supplychainsecurity #cybersecurity #security