1K+ Cloud Environments Compromised in Trivy Supply Chain Attack

• •Over 1,000 cloud environments infected due to a Trivy supply chain attack.
• •Attackers exploited a misconfiguration in Trivy's GitHub Action to push malicious updates.
• •Collaboration with extortion groups like Lapsus$ indicates a systemic threat.

A supply chain attack targeting the Trivy open source scanner has infected over 1,000 cloud environments with secret-stealing malware. The attack, which occurred last week, has been attributed to a group called TeamPCP, who compromised Trivy version 0.69.4 by exploiting a misconfiguration in its GitHub Action component. This vulnerability allowed attackers to push malicious container images and GitHub releases to users, leading to the theft of sensitive information such as API keys and database credentials. Security experts warn that the number of affected environments could rise significantly, potentially reaching tens of thousands. The attackers are collaborating with notorious extortion groups like Lapsus$, known for their aggressive tactics. The attack also impacted other tools like liteLLM, which is present in 36% of cloud environments. Security teams are urged to take immediate action to mitigate the threat. The attackers have indicated plans to target additional popular open source projects in the future.