Tracked topic
Trivy is an open source vulnerability scanner for container images, files, and code that detects known security issues in software dependencies.
… Februar hatte ein Angreifer über eine Fehlkonfiguration in Trivys Github-Actions-Umgebung ein sogenanntes Personal Access Token extrahiert, also einen langlebigen Zugriffsschlüssel mit Schreibrechten auf die Trivy-Repositories. …
… This post summarizes what happened, what Docker did in response, and what you should do if you use Trivy.
Trivy, KICS, and the shape of supply chain attacks so far in 2026 | Docker
Coordinates : 46°23′14″N 4°29′34″E / 46.3872°N 4.4928°E / 46.3872; 4.4928 From Wikipedia, the free encyclopedia Commune in Bourgogne-Franche-Comté, France Trivy Commune The church in Trivy Location of Trivy Trivy Show map of France Trivy Show map of Bourgogne-Franche-Comté Coordinates: 46°23′… …
… The software was subverted on March 19, when attackers referred to as TeamPCP used compromised credentials to publish a malicious Trivy release v0.69.4 , and again on March 22, when malicious Trivy versions v0.69.5 and v0.69.6 were published as DockerHub images. …
… Socket and Google-owned Wiz researchers over the weekend determined that the attack compromised multiple components of the Trivy project: the core scanner, the trivy-action GitHub Action, and the setup-trivy GitHub Action, and force-pushed 75 out of 76 trivy-action tags to malicious versions, meani… …
… Following a report that TeamPCP also breached Cisco's internal development environment and stole source code from credentials swiped via the Trivy attack, Cisco told The Register that it is "aware of the Trivy supply-chain issue that is affecting the industry." MORE CONTEXT 1K+ cloud environments i… …
… A company spokesperson confirmed to BleepingComputer that the threat actor obtained credentials to the repositories from the Trivy supply-chain attack in March. …
… Then, just two weeks after Trivy, another supply chain attack hit a different open-source library. …
Cyber-crime Telnyx joins LiteLLM in latest PyPI package poisoning tied to Trivy breach Also, EU probes Snapchat, RedLine suspect extradited, AstraZeneca leak claim surfaces, and more INFOSEC IN BRIEF The cybercrime crew linked to the Trivy supply-chain attack has struck again, this time pushing mal… …
