Zrobiłem wszystko dobrze. I tak mnie okradli.

🚨 Nie klikasz żadnych dziwnych linków, nie uruchamiasz żadnych załączników ani w sumie żadnego badziewia, nie odwiedzasz podejrzanych serwisów? Świetnie. Robisz dokładnie to, co wszyscy - w tym ja - mówią Ci, że trzeba robić, aby być bezpiecznym. I co? No i nic, nadal padasz ofiarą ataku. Co dzieje się kiedy wektorami ataku stają się ci, którzy mieli nas przed nimi bronić? Linki: 1️⃣ trivy - The All-in-One Security Scanner https://trivy.dev/ ❗️ Trivy Security incident 2026-03-19 conclusion https://github.com/aquasecurity/trivy/discussions/10462 2️⃣ Trivy Compromised a Second Time - Malicious v0.69.4 Release, aquasecurity/setup-trivy, aquasecurity/trivy-action GitHub Actions Compromised https://www.stepsecurity.io/blog/trivy-compromised-a-second-time---malicious-v0-69-4-release 🐦 Ahmad Nassri @ Twitter https://x.com/AhmadNassri/status/2035854809845436500 ⛓️‍💥 Trivy Supply Chain Attack Expands to Compromised Docker Images https://socket.dev/blog/trivy-docker-images-compromised 🔓 TeamPCP Is Systematically Targeting Security Tools Across the OSS Ecosystem https://socket.dev/blog/teampcp-targeting-security-tools-across-oss-ecosystem 🚨 Checkmarx Security Update https://checkmarx.com/blog/checkmarx-security-update/ 🔫 Weaponizing the Protectors: TeamPCP’s Multi-Stage Supply Chain Attack on Security Infrastructure https://unit42.paloaltonetworks.com/teampcp-supply-chain-attacks/ ⚙️ GitHub Actions. Automate your workflow from idea to production https://github.com/features/actions 💻 How LiteLLM Turned Developer Machines Into Credential Vaults for Attackers https://thehackernews.com/2026/04/how-litellm-turned-developer-machines.html ⛓️ Security Update: Suspected Supply Chain Incident https://docs.litellm.ai/blog/security-update-march-2026 🪱 TeamPCP deploys CanisterWorm on NPM following Trivy compromise https://www.aikido.dev/blog/teampcp-deploys-worm-npm-trivy-compromise ⛄️ The Team PCP Snowball Effect: A Quantitative Analysis https://blog.gitguardian.com/team-pcp-snowball-analysis/ 🐦 @vxunderground @ Twitter https://x.com/vxunderground/status/2036532168084672816 🐦 @ishaan_jaff @ Twitter https://x.com/ishaan_jaff/status/2038728575386521723 🚪 Popular AI gateway startup LiteLLM ditches controversial startup Delve https://techcrunch.com/2026/03/30/popular-ai-gateway-startup-litellm-ditches-controversial-startup-delve/ 🚦 Silicon Valley’s two biggest dramas have intersected: LiteLLM and Delve https://techcrunch.com/2026/03/26/delve-did-the-security-compliance-on-litellm-an-ai-project-hit-by-malware/ 😭 Cisco source code stolen in Trivy-linked dev environment breach https://www.bleepingcomputer.com/news/security/cisco-source-code-stolen-in-trivy-linked-dev-environment-breach/ 🔑 TeamPCP Campaign Spreads to npm via a Hijacked Bitwarden CLI https://research.jfrog.com/post/bitwarden-cli-hijack/ 📃 Bitwarden Statement on Checkmarx Supply Chain Incident https://community.bitwarden.com/t/bitwarden-statement-on-checkmarx-supply-chain-incident/96127 📊 A running tracker for the coordinated supply chain attack campaign attributed to TeamPCP https://teampcp.cyberdigest.international/ 🇪🇺 European Commission cloud breach: a supply-chain compromise https://cert.europa.eu/blog/european-commission-cloud-breach-trivy-supply-chain 🌩️ Security Notice: Impact of CVE-2026-33634 on ownCloud Build Infrastructure https://owncloud.com/security-advisories/security-notice-impact-of-cve-2026-33634-on-owncloud-build-infrastructure/ 🇮🇷 ‘CanisterWorm’ Springs Wiper Attack Targeting Iran https://krebsonsecurity.com/2026/03/canisterworm-springs-wiper-attack-targeting-iran/ 🦷 CanisterWorm Gets Teeth: TeamPCP's Kubernetes Wiper Targets Iran https://www.aikido.dev/blog/teampcp-stage-payload-canisterworm-iran 🐦 Itay Shakury (@itaysk) is leaving https://github.com/aquasecurity/trivy/discussions/10563 © Wszystkie znaki handlowe należą do ich prawowitych właścicieli. ❤️ Dziękuję za Waszą uwagę. Znajdziecie mnie również na: Instagramie @mateuszemsi https://www.instagram.com/mateuszemsi/ Twixxerze @MateuszChrobok https://twitter.com/MateuszChrobok Mastodonie https://infosec.exchange/@mateuszchrobok LinkedInie @mateuszchrobok https://www.linkedin.com/in/mateuszchrobok/ Patronite https://patronite.pl/MateuszChrobok Rozdziały: 00:00 Intro 01:13 Wpadka 07:08 Cel 09:01 Post Mortem 11:22 LiteLLM 16:31 Inni 18:35 Okup 22:37 Co Robić i Jak Żyć? #Trivy #LiteLLM #npm #programowanie #wyciek