Trivy Scanner Compromised: CanisterWorm Self-Propagating Across 47 npm Packages

TeamPCP criticizes Trivy / Shared entities / Same source / Shared topic / Earlier coverage

Trivy Scanner Compromised: 75 of 76 GitHub Actions Tags Hijacked

Linked by a graph relationship (TeamPCP criticizes Trivy); both cover GitHub Action, Rotate, SSH, TeamPCP; cite the same source (Source).

Trivy criticizes LiteLLM / Shared entities / Shared topic / What happened next

CISA Confirms: Your AI Security Scanner Got Backdoored. Federal Deadline Is April 8.

Linked by a graph relationship (Trivy criticizes LiteLLM); both cover GitHub Action, Kubernetes, SSH, TeamPCP; overlapping topics (action, credential, trivy).

TeamPCP criticizes Trivy / Shared entities / Shared topic / What happened next

LiteLLM Got Backdoored. The Attack Vector? Their Own Security Scanner.

Linked by a graph relationship (TeamPCP criticizes Trivy); both cover AES, Kubernetes, SSH, TeamPCP; overlapping topics (action, cloud, credential).

TeamPCP criticizes Trivy / Shared entities / What happened next

The Security Scanner Was the Attack Vector. 10,000 CI/CD Workflows Compromised.

Linked by a graph relationship (TeamPCP criticizes Trivy); both cover GitHub Action, Kubernetes, SSH, TeamPCP; picks up the GitHub Action thread on 2026-03-27.

Trivy criticizes LiteLLM / Shared entities / Same source domain / Shared topic / What happened next

Two poisoned LiteLLM releases drained credentials from 2,500 orgs and 434,000 CI/CD pipelines

Linked by a graph relationship (Trivy criticizes LiteLLM); both cover Kubernetes, SSH, Trivy; reported by the same outlet (arstechnica.com).

TeamPCP criticizes Trivy / Shared entities / Shared topic / What happened next

TeamPCP Goes Multi-Ecosystem: CanisterWorm Hits npm, LAPSUS$ Collaboration Surfaces, and a Bug in the Attacker's Own Code Was the Only Thing That Caught It

Linked by a graph relationship (TeamPCP criticizes Trivy); both cover CanisterWorm, TeamPCP, Trivy; overlapping topics (action, canisterworm, cloud, compromised).

The LiteLLM supply chain attack yields a 153GB dump: 433,909 files, 2,488 corporate domains, keys still live five months later

Linked by a graph relationship (TeamPCP criticizes Trivy); both cover Rotate, TeamPCP, Trivy; overlapping topics (compromised, credential, secret).

The Largest npm Worm of 2026 Carries Valid Supply Chain Attestations. That's the Real Problem.

Linked by a graph relationship (TeamPCP criticizes Trivy); both cover GitHub Action, Kubernetes, TeamPCP; overlapping topics (action, compromised, packag).