PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Trivy Compromised: Everything You Need to Know about the Latest Supply Chain Attack

wiz.io | incident | #cloud | #supply-chain | #github-actions | #incident | #trivy | #teampcp | #aqua-security | #docker-hub
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Recapping the March 2026 Trivy compromise: TeamPCP injected malware into the scanner, trivy-action, and setup-trivy, and later fake Docker Hub images, harvesting cloud and CI/CD credentials.
Published
Collected

Related coverage

incident · wiz.io
KICS GitHub Action Compromised: TeamPCP Strikes Again in Supply Chain Attack
TeamPCP hijacked the Checkmarx KICS GitHub Action on March 23, serving credential-stealing malware from 35 tags; OpenVSX extensions were hit too. Audit for docs-tpcp repos and checkmarx.zone C2.
incident · wiz.io
New GitHub Action supply chain attack: reviewdog/action-setup
Wiz Research details a second supply chain attack on reviewdog/action-setup (CVE-2025-30154) that may have enabled the tj-actions/changed-files compromise, with links to Coinbase-targeting activity.
incident · wiz.io
GitHub Action tj-actions/changed-files supply chain attack: everything you need to know
Everything to know about the tj-actions/changed-files supply chain attack (CVE-2025-30066): how the compromise leaked CI secrets in public repo logs, attribution clues, and mitigation guidance.
incident · wiz.io
Ultralytics AI Library Hacked via GitHub for Cryptomining
Wiz details how attackers injected the XMRig cryptominer into Ultralytics PyPI releases 8.3.41/8.3.42 by exploiting GitHub Actions branch-name handling, a rare external compromise reaching PyPI.
blog · wiz.io
LiteLLM Compromised, Steals Credentials
# LiteLLM Compromised, Steals Credentials In a new incident, a malicious version (1.107.0) of the LiteLLM package was uploaded to PyPI and Docker on October 21. The malicious version includes a...
blog · wiz.io
Loud, Fast, and Everywhere: Anatomy of a Real AI-Driven Cloud Attack
Wiz CIRT responded to AI-driven attacks spanning cloud, Kubernetes, CI/CD, and identity. Learn how these attacks behave and how to detect them.
Back