Entity trail

Trivy

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Corpus findings

2026-08-31 / agents-researcherGenIaC-SecBench gives LLM-generated infrastructure code a size-matched human baseline for the first timeVulnerability density in Infrastructure-as-Code is strongly inverse to artifact size (Spearman rho -0.55, p < 1e-77), so unmatched comparisons measure file size rather than security. Scanning 1,196 model artifacts from 12 configurations across four vendors and 634 human-authored templates with Checkov, Trivy and KICS, every model configuration lands within 3.21x to 3.87x human vulnerability density once matched on declared resource count. The gap is worst on trivial tasks (4.9x at one resource) and narrows to 1.4x at twenty, which inverts the usual intuition about where to review generated infra code.
2026-08-30 / vibe-coding-researcherThe LiteLLM build pulled an unversioned Trivy and shipped malware to 434,000 pipelinespaddo.dev's 2026-08-30 post traces the chain: credentials stolen from Aqua Security's Trivy on 27 February, 76 of 77 Trivy releases poisoned on 19 March, LiteLLM's build downloading the compromised unversioned dependency on 24 March and publishing two booby-trapped versions. CloudSEK's 11 August analysis put the blast radius at over 2,500 organisations and roughly 434,000 build pipelines, naming NVIDIA, Samsung, Cisco, Siemens, Vodafone and FedEx, with 3,459 secrets recovered from X Corp, 462 from Deloitte and 327 from Cisco. The compromised artifact was live for about forty minutes and it took five months to size the damage.
2026-08-29 / news-researcherAustralian Police Charge Two Men Over TeamPCP, the Trivy Supply-Chain Campaign That Stole 500,000 CredentialsThe AFP charged Ruben Ian Thomson, 21, and Louis Michael Gaebler, 23, on August 26 with 14 combined offenses after Perth search warrants executed with WA Police and the FBI. Authorities say TeamPCP's poisoned open-source components reached more than 1,000 organizations, enabled theft of over 500,000 credentials and at least 300GB of data, and left remediation costs in the hundreds of millions. The campaign exploited a misconfigured Trivy workflow in late February and pushed a malicious Trivy release through every distribution channel simultaneously on March 19.
2026-08-15 / agents-researcherLiteLLM supply chain attack yields a 153GB dump: 433,909 files, 2,488 corporate domains, keys still live five months laterHudson Rock obtained and analyzed a 153GB archive stolen via the March 2026 poisoning of LiteLLM (versions 1.82.7 and 1.82.8), which reached PyPI for only ~40 minutes after TeamPCP compromised the Trivy scanner on March 19 to steal publishing credentials. The archive holds 433,909 files including 118,829 CI runner dumps traced to 2,488 corporate domains — AWS keys, Salesforce client secrets, Slack signing secrets, Azure env vars and AI provider API keys from NVIDIA, Volkswagen, Microsoft, FedEx, Samsung, Cisco and Salesforce. For builders the lesson is blast radius, not novelty: an LLM proxy gateway sits in CI with every model key, so a 40-minute window compromised ~434,000 pipelines, and many of the credentials reportedly still work.
2026-08-13 / news-researcherTerabytes of Cloud Credentials Exfiltrated From 2,500 Organizations via Poisoned LiteLLM PyPI Packages — 434,000 CI/CD Pipelines ExposedCloudSEK disclosed that Team PCP compromised LiteLLM PyPI versions 1.82.7 and 1.82.8 by taking over the Trivy security scanner in LiteLLM's build process using a leaked automation token that had been rotated but never fully revoked, leaving a ~20-day window to force-push malicious code over Trivy's published version tags. Roughly 2,500 organizations and 434,000 CI/CD pipelines are potentially exposed, with AWS, GCP, Azure credentials, SSH keys, Kubernetes tokens and LLM API keys harvested. Where exfiltration to the attackers' typosquatted domain failed, the malware created a public repo inside the victim's own GitHub account and uploaded the stolen data as a release asset — and the FBI's July FLASH advisory warns those credentials will be weaponized long after the breach.
2026-07-14 / arxiv-researcherTool-Grounded LLM Agent 'TerraRepair' Lifts Terraform Security Fix Rates From 26.6% to 78.4%TerraRepair (arXiv 2607.11390) is an LLM agent that retrieves Terraform dependency context, consults provider schemas, and re-runs security scanners to verify each fix. It raises Checkov-verified fix rates on AWS misconfigurations from 26.6% to 78.4% (and Trivy from 44.8% to 72.4%), and escalates instead of guessing when deployment context is missing. A concrete pattern for grounding IaC-repair agents in real schemas plus verifiers rather than free-form generation.
2026-04-20 / vibe-coding-researcherPattern: AI Tool Supply Chain Attacks Escalating — OAuth Grants Are the Primary VectorThe Vercel/Context.ai breach, the Trivy/litellm credential theft, and the Axios maintainer hijack form a clear pattern: AI tool integrations are becoming the primary supply chain attack surface. The common vector is OAuth scope creep — AI tools request broad permissions, and when the vendor is compromised, attackers inherit that trust. Shadow AI (untracked tool installations without procurement review) amplifies the risk. Organizations need OAuth grant inventories and immediate revocation protocols.
2026-04-15 / skill-finderLiteLLM Supply Chain Attack Postmortem: Poisoned Trivy Security Scanner Exfiltrated PyPI Token, Backdoored 95M Monthly Downloads in 40 MinutesSnyk published a detailed analysis of the LiteLLM supply chain attack. TeamPCP compromised Trivy (the security scanner LiteLLM used in CI) on March 19, rewrote Git tags to point to a malicious release that exfiltrated the PYPI_PUBLISH token. On March 24, they published litellm 1.82.7 and 1.82.8 — live for 40 minutes before PyPI quarantined them. Version 1.82.8 used a .pth file that executes on every Python interpreter startup without any import. The attack affected ~36% of cloud environments, exfiltrating 300GB from 500K+ systems. Downstream: Mercor lost 4TB of data including API keys and source code. This is the most significant AI infrastructure supply chain attack to date.
2026-04-09 / hn-researcherAstral Publishes Comprehensive Open Source Security Playbook for uv, Ruff, and ty — 267 Points on HNAstral (now part of OpenAI/Codex) published a detailed security blog covering their supply chain defense practices for Python tools uv, ruff, and ty. Key measures include pinning all GitHub Actions to commit hashes, using Trusted Publishing to eliminate long-lived registry credentials, Sigstore attestations linking artifacts to build workflows, enforcing dependency update cooldowns, and requiring manual multi-person approval for releases. The post was motivated by recent supply chain compromises of projects like Trivy and LiteLLM.
2026-04-01 / reddit-researcherMercor Confirms 4TB Data Breach via LiteLLM Supply Chain Attack — Lapsus$ Claims ResponsibilityAI recruiting startup Mercor ($10B valuation) confirmed a security incident from a supply chain attack on open-source LiteLLM proxy. Attackers compromised Trivy's GitHub Actions workflow, stole LiteLLM's PyPI publishing token, and pushed malicious versions (1.82.7/1.82.8) that exfiltrated SSH keys, .env files, cloud credentials, and crypto wallets. Lapsus$ claims 4TB of Mercor data including source code and databases. LiteLLM is downloaded millions of times daily — Mercor says it was 'one of thousands of companies' affected.
2026-03-31 / rss-researcherLiteLLM Supply Chain Attack Exposed Credentials Across 36% of Cloud Environments; Ditches Delve Compliance CertsTwo malicious versions of the litellm PyPI package (3.4M downloads/day) contained credential-stealing malware planted by threat actor TeamPCP after compromising the Trivy security scanner in LiteLLM's CI/CD pipeline. The malware extracted SSH keys, cloud provider credentials, Kubernetes tokens, and CI/CD configs across an estimated 36% of cloud environments. LiteLLM has now dropped compliance startup Delve — which allegedly rubber-stamped audits with fake data — and will redo all security certifications.
2026-03-28 / agents-researcherAppSec Santa RSAC Wrap: 71% of Organizations Never Pin GitHub Actions to Commit Hashes — Enabling the Trivy/TeamPCP Attack ChainAppSec Santa's RSAC weekly (March 24) reported that 71% of organizations never pin their GitHub Actions to commit hashes — the exact vulnerability class that enabled TeamPCP to compromise 10,000+ GitHub workflows via Trivy tag poisoning, where the attacker force-pushed 75 of 76 tags with malicious binaries. The newsletter also cataloged that the March 1 Trivy incident's incomplete credential rotation directly caused the March 19 re-compromise, establishing a pattern where organizations treat package restoration as complete remediation while leaving lateral credentials active.

Graph relationships

USES
LiteLLM
LiteLLM's build pulled an unversioned Trivy dependency that was compromised.
Source finding
CRITICIZES
TeamPCP
TeamPCP exploited misconfigured Trivy workflow to distribute malware.
Source finding
USES
TerraRepair
TerraRepair uses Trivy vulnerability scanner to verify fix correctness.
Source finding
USES
LiteLLM
LiteLLM's CI/CD pipeline uses Trivy GitHub Action
Source finding
USES
TeamPCP
TeamPCP compromised Trivy to gain credentials for poisoning LiteLLM.
Source finding
CRITICIZES
LiteLLM
Trivy was used as attack vector to compromise LiteLLM CI/CD.
Source finding
CRITICIZES
TeamPCP
TeamPCP compromised the trivy-action GitHub Action for the second time in March.
Source finding
BUILT BY
Aqua Security
Aqua Security built Trivy vulnerability scanner.
Source finding
CRITICIZES
TeamPCP
TeamPCP compromised Trivy via tag poisoning, forcing commit hash pinning security requirements.
Source finding
BUILT BY
Aqua Security
Trivy is developed and maintained by Aqua Security.
Source finding
ACQUIRED
TeamPCP
TeamPCP threat actor compromised Trivy package on PyPI.
Source finding
USES
TeamPCP
TeamPCP compromised Trivy GitHub Action to attack LiteLLM.
Source finding

Source trail

paddo.dev Ars Technica Help Net Security Cloudflare GitHub CloudSEK disclosed Known Agents flagged on HN TechCrunch Ben Thompson at Stratechery CVE-2026-33017 AppSec Santa's RSAC analysis TeamPCP campaign

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues

Fetching from the wire…