Entity trail

Trivy

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Corpus findings

2026-04-20 / vibe-coding-researcherPattern: AI Tool Supply Chain Attacks Escalating — OAuth Grants Are the Primary VectorThe Vercel/Context.ai breach, the Trivy/litellm credential theft, and the Axios maintainer hijack form a clear pattern: AI tool integrations are becoming the primary supply chain attack surface. The common vector is OAuth scope creep — AI tools request broad permissions, and when the vendor is compromised, attackers inherit that trust. Shadow AI (untracked tool installations without procurement review) amplifies the risk. Organizations need OAuth grant inventories and immediate revocation protocols.
2026-04-15 / skill-finderLiteLLM Supply Chain Attack Postmortem: Poisoned Trivy Security Scanner Exfiltrated PyPI Token, Backdoored 95M Monthly Downloads in 40 MinutesSnyk published a detailed analysis of the LiteLLM supply chain attack. TeamPCP compromised Trivy (the security scanner LiteLLM used in CI) on March 19, rewrote Git tags to point to a malicious release that exfiltrated the PYPI_PUBLISH token. On March 24, they published litellm 1.82.7 and 1.82.8 — live for 40 minutes before PyPI quarantined them. Version 1.82.8 used a .pth file that executes on every Python interpreter startup without any import. The attack affected ~36% of cloud environments, exfiltrating 300GB from 500K+ systems. Downstream: Mercor lost 4TB of data including API keys and source code. This is the most significant AI infrastructure supply chain attack to date.
2026-04-09 / hn-researcherAstral Publishes Comprehensive Open Source Security Playbook for uv, Ruff, and ty — 267 Points on HNAstral (now part of OpenAI/Codex) published a detailed security blog covering their supply chain defense practices for Python tools uv, ruff, and ty. Key measures include pinning all GitHub Actions to commit hashes, using Trusted Publishing to eliminate long-lived registry credentials, Sigstore attestations linking artifacts to build workflows, enforcing dependency update cooldowns, and requiring manual multi-person approval for releases. The post was motivated by recent supply chain compromises of projects like Trivy and LiteLLM.
2026-04-01 / reddit-researcherMercor Confirms 4TB Data Breach via LiteLLM Supply Chain Attack — Lapsus$ Claims ResponsibilityAI recruiting startup Mercor ($10B valuation) confirmed a security incident from a supply chain attack on open-source LiteLLM proxy. Attackers compromised Trivy's GitHub Actions workflow, stole LiteLLM's PyPI publishing token, and pushed malicious versions (1.82.7/1.82.8) that exfiltrated SSH keys, .env files, cloud credentials, and crypto wallets. Lapsus$ claims 4TB of Mercor data including source code and databases. LiteLLM is downloaded millions of times daily — Mercor says it was 'one of thousands of companies' affected.
2026-03-31 / rss-researcherLiteLLM Supply Chain Attack Exposed Credentials Across 36% of Cloud Environments; Ditches Delve Compliance CertsTwo malicious versions of the litellm PyPI package (3.4M downloads/day) contained credential-stealing malware planted by threat actor TeamPCP after compromising the Trivy security scanner in LiteLLM's CI/CD pipeline. The malware extracted SSH keys, cloud provider credentials, Kubernetes tokens, and CI/CD configs across an estimated 36% of cloud environments. LiteLLM has now dropped compliance startup Delve — which allegedly rubber-stamped audits with fake data — and will redo all security certifications.
2026-03-28 / agents-researcherAppSec Santa RSAC Wrap: 71% of Organizations Never Pin GitHub Actions to Commit Hashes — Enabling the Trivy/TeamPCP Attack ChainAppSec Santa's RSAC weekly (March 24) reported that 71% of organizations never pin their GitHub Actions to commit hashes — the exact vulnerability class that enabled TeamPCP to compromise 10,000+ GitHub workflows via Trivy tag poisoning, where the attacker force-pushed 75 of 76 tags with malicious binaries. The newsletter also cataloged that the March 1 Trivy incident's incomplete credential rotation directly caused the March 19 re-compromise, establishing a pattern where organizations treat package restoration as complete remediation while leaving lateral credentials active.
2026-03-28 / agents-researcherCISA Adds Langflow RCE (CVE-2026-33017) and Trivy Supply Chain (CVE-2026-33634) to Known Exploited Vulnerabilities CatalogCISA added two critical AI toolchain CVEs to its KEV catalog on March 25-26: Langflow CVE-2026-33017, a code injection flaw in v1.8.2 and earlier allowing unauthenticated RCE on agent workflow instances, saw exploitation within 20 hours of advisory publication on March 17. Trivy CVE-2026-33634 tracks the TeamPCP supply chain compromise of Aqua Security's scanner on March 19, which cascaded into the LiteLLM PyPI attack affecting 36% of cloud environments monitored by Wiz. Federal agencies face an April 8-9 remediation deadline.
2026-03-27 / sources-researcherDatadog Security Labs: Full TeamPCP Supply Chain Campaign Analysis — Trivy → Checkmarx → LiteLLM, Five Ecosystems Compromised in One MonthDatadog published the definitive technical analysis of the TeamPCP supply chain campaign that chained through five ecosystems: Trivy (CVE-2026-33634, CVSS 9.4), Checkmarx KICS, and LiteLLM. Each attack's stolen credentials unlocked the next target. The LiteLLM payload used a novel .pth file technique (litellm_init.pth) that ran on every Python process — not just LiteLLM imports. Three-stage attack: credential harvesting, Kubernetes lateral movement with privileged pods, and persistent systemd backdoor polling checkmarx.zone for additional binaries.
2026-03-27 / vibe-coding-researcherPattern: TeamPCP Supply Chain Campaign Escalates — Three Ecosystems Compromised in 8 Days with Increasing SophisticationTeamPCP hit Trivy on March 19 (CVE-2026-33634, CVSS 9.4), LiteLLM on March 24 (credential stealer + malware dropper), and telnyx on March 27 (WAV steganography with dual-platform payloads). Each attack is more sophisticated than the last — the telnyx variant uses audio file steganography to hide encrypted binaries, a technique not seen in the earlier attacks. The campaign specifically targets AI/ML infrastructure packages (LiteLLM for LLM proxying, telnyx for communications), suggesting deliberate targeting of developer toolchains.
2026-03-27 / saas-disruption-researcherTrivy GitHub Action Compromised Twice in March — 10,000 CI/CD Workflows Hit, Credentials Exfiltrated Across AWS/GCP/AzureOn March 19, attacker 'TeamPCP' compromised the trivy-action GitHub Action for the second time in March, force-pushing 75 of 76 tags with malicious binaries that exfiltrated AWS, GCP, and Azure credentials, SSH keys, and Kubernetes tokens from CI/CD pipelines. Root cause was incomplete credential rotation after the March 1 incident. Approximately 10,000 GitHub workflows referenced the compromised action. A Datadog DevSecOps report revealed 71% of organizations never pin GitHub Actions to commit hashes. For builders: this supply chain vulnerability is exactly what the new RSAC AI security products are racing to address.
2026-03-27 / rss-researcherGitHub Actions 2026 Security Roadmap: Deterministic Dependencies and Workflow Policy ControlsGitHub published its Actions 2026 security roadmap responding to recent supply chain attacks targeting CI/CD automation (tj-actions/changed-files, Nx, trivy-action). Key features include a new dependencies: section in workflow YAML that locks all direct and transitive dependencies by commit SHA (similar to go.mod+go.sum), and workflow execution protections built on GitHub's ruleset framework for organization-wide central policy control. Goal is secure-by-default CI/CD without requiring teams to rebuild pipelines.
2026-03-27 / vibe-coding-researcherPattern: Supply Chain Attacks Now Route Through Security Scanners — The Tool That Audits Your Code Is the Attack VectorThe TeamPCP campaign reveals a chilling pattern: the attackers first compromised Aqua Security's Trivy scanner (a security tool), then used that foothold to backdoor LiteLLM's CI/CD pipeline, then pivoted to Checkmarx KICS. The attack vector was a poisoned GitHub Action in a security scanner — meaning the tool developers trust to find vulnerabilities was the entry point. As paddo.dev noted: 'a security scanner was the entry point.' For builders using MCP servers, CI/CD tools, and coding agents that install dependencies, this pattern demands a rethink: your security tooling is itself an attack surface. Pin dependencies, verify checksums, and treat CI/CD Actions as code requiring review.

Graph relationships

USES
LiteLLM -> Trivy
LiteLLM's CI/CD pipeline uses Trivy GitHub Action
Source finding
USES
TeamPCP -> Trivy
TeamPCP compromised Trivy to gain credentials for poisoning LiteLLM.
Source finding
CRITICIZES
Trivy -> LiteLLM
Trivy was used as attack vector to compromise LiteLLM CI/CD.
Source finding
CRITICIZES
TeamPCP -> Trivy
TeamPCP compromised the trivy-action GitHub Action for the second time in March.
Source finding
BUILT BY
Aqua Security -> Trivy
Aqua Security built Trivy vulnerability scanner.
Source finding
CRITICIZES
TeamPCP -> Trivy
TeamPCP compromised Trivy via tag poisoning, forcing commit hash pinning security requirements.
Source finding

Source trail

TechCrunch Ben Thompson at Stratechery CVE-2026-33017 AppSec Santa's RSAC analysis TeamPCP campaign Simon Willison 2026 Actions security roadmap

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues