Connect with us
DAPA Banner

Tech

Trivy vulnerability scanner breach pushed infostealer via GitHub Actions

Published

on

Trivy

The Trivy vulnerability scanner was compromised in a supply-chain attack by threat actors known as TeamPCP, which distributed credential-stealing malware through official releases and GitHub Actions.

Trivy is a popular security scanner that helps identify vulnerabilities, misconfigurations, and exposed secrets across containers, Kubernetes environments, code repositories, and cloud infrastructure. Because developers and security teams commonly use it, it is a high-value target for attackers to steal sensitive authentication secrets.

The breach was first disclosed by security researcher Paul McCarty, who warned that Trivy version 0.69.4 had been backdoored, with malicious container images and GitHub releases published to users.

Further analysis by Socket and later by Wiz determined that the attack affected multiple GitHub Actions, compromising nearly all version tags of the trivy-action repository.

Advertisement

Researchers found that threat actors compromised Trivy’s GitHub build process, swapping the entrypoint.sh in GitHub Actions with a malicious version and publishing trojanized binaries in the Trivy v0.69.4 release, both of which acted as infostealers across the main scanner and related GitHub Actions, including trivy-action and setup-trivy.

The attackers abused a compromised credential with write access to the repository, allowing them to publish malicious releases. These compromised credentials are from an earlier March breach, in which credentials were exfiltrated from Trivy’s environment and not fully contained.

The threat actor force-pushed 75 out of 76 tags in the aquasecurity/trivy-action repository, redirecting them to malicious commits.

As a result, any external workflows using the affected tags automatically executed the malicious code before running legitimate Trivy scans, making the compromise difficult to detect.

Advertisement

Socket reports that the infostealer collected reconnaissance data and scanned systems for a wide range of files and locations known to store credentials and authentication secrets, including:

  • Reconnaissance data: hostname, whoami, uname, network configuration, and environment variables
  • SSH: private and public keys and related configuration files
  • Cloud and infrastructure configs: Git, AWS, GCP, Azure, Kubernetes, and Docker credentials
  • Environment files: .env and related variants
  • Database credentials: configuration files for PostgreSQL, MySQL/MariaDB, MongoDB, and Redis
  • Credential files: including package manager and Vault-related authentication tokens
  • CI/CD configurations: Terraform, Jenkins, GitLab CI, and similar files
  • TLS private keys
  • VPN configurations
  • Webhooks: Slack and Discord tokens
  • Shell history files
  • System files: /etc/passwd, /etc/shadow, and authentication logs
  • Cryptocurrency wallets
Infostealer harvesting credentials, SSH keys, and environment files
Infostealer harvesting credentials, SSH keys, and environment files
Source: BleepingComputer

The malicious script would also scan memory regions used by the GitHub Actions Runner.Worker process for the JSON string “" ":{ "value": "", "isSecret":true}” to find additional authentication secrets.

On developer machines, the trojanized Trivy binary performed similar data collection, gathering environment variables, scanning local files for credentials, and enumerating network interfaces.

Collected data was encrypted and stored in an archive named tpcp.tar.gz, which was then exfiltrated to a typosquatted command-and-control server at scan.aquasecurtiy[.]org.

If exfiltration failed, the malware created a public repository named tpcp-docs within the victim’s GitHub account and uploaded the stolen data there.

Advertisement

To persist on a compromised device, the malware would also drop a Python payload at ~/.config/systemd/user/sysmon.py and register it as a systemd service. This payload would check a remote server for additional payloads to drop, giving the threat actor persistent access to the device.

The attack is believed to be linked to a threat actor known as TeamPCP, as one of the infostealer payloads used in the attack has a “TeamPCP Cloud stealer” comment as the last line of the Python script.

“The malware self-identifies as TeamPCP Cloud stealer in a Python comment on the final line of the embedded filesystem credential harvester. TeamPCP, also tracked as DeadCatx3, PCPcat, and ShellForce, is a documented cloud-native threat actor known for exploiting misconfigured Docker APIs, Kubernetes clusters, Ray dashboards, and Redis servers,” explains Socket.

Comment showing the script was named TeamPCP Cloud Stealer
Comment showing the script was named TeamPCP Cloud Stealer
Source: BleepingComputer

Aqua Security confirmed the incident, stating that a threat actor used compromised credentials from the earlier incident that was not properly contained.

“This was a follow up from the recent incident (2026-03-01) which exfiltrated credentials. Our containment of the first incident was incomplete,” explained Aqua Security.

Advertisement

“We rotated secrets and tokens, but the process wasn’t atomic and attackers may have been privy to refreshed tokens.”

The malicious Trivy release (v0.69.4) was live for approximately three hours, with compromised GitHub Actions tags remaining active for up to 12 hours.

The attackers also tampered with the project’s repository, deleting Aqua Security’s initial disclosure of the earlier March incident.

Organizations that used affected versions during the incident should treat their environments as fully compromised.

Advertisement

This includes rotating all secrets, such as cloud credentials, SSH keys, API tokens, and database passwords, and analyzing systems for additional compromise.

Follow-up attack spreads CanisterWorm via npm

Researchers at Aikido have also linked the same threat actor to a follow-up campaign involving a new self-propagating worm named “CanisterWorm,” which targets npm packages.

The worm compromises packages, installs a persistent backdoor via a systemd user service, and then uses stolen npm tokens to publish malicious updates to other packages.

“Self-propagating worm. deploy.js takes npm tokens, resolves usernames, enumerates all publishable packages, bumps patch versions, and publishes the payload across the entire scope. 28 packages in under 60 seconds,” highlights Aikido.

Advertisement

The malware uses a decentralized command-and-control mechanism using Internet Computer (ICP) canisters, which act as a dead-drop resolver that provides URLs for additional payloads. 

Using ICP canisters makes the operation more resistant to takedown, as only the canister’s controller can remove it, and any attempt to stop it would require a governance proposal and network vote.

The worm also includes functionality to harvest npm authentication tokens from configuration files and environment variables, enabling it to spread across developer environments and CI/CD pipelines.

At the time of analysis, some of the secondary payload infrastructure was inactive or configured with harmless content, but the researchers say this could change at any time.

Advertisement

Malware is getting smarter. The Red Report 2026 reveals how new threats use math to detect sandboxes and hide in plain sight.

Download our analysis of 1.1 million malicious samples to uncover the top 10 techniques and see if your security stack is blinded.

Source link

Continue Reading
Click to comment

You must be logged in to post a comment Login

Leave a Reply

Tech

Publisher pulls horror novel ‘Shy Girl’ over AI concerns

Published

on

Hachette Book Group said it will not be publishing a novel called “Shy Girl” over concerns that artificial intelligence was used to generate the text.

The novel was scheduled to be published in the United States this spring. Hachette said it will also discontinue the book in the United Kingdom, where it’s already available. 

Although the publisher claimed the decision came after a thorough review of the text, reviewers on GoodReads and YouTube had been speculating that the book was likely AI-generated. And The New York Times said it asked Hachette about the “Shy Girl” concerns the day before the announcement.

In an email to the NYT, author Mia Ballard denied using AI to write her novel, instead blaming an acquaintance she’d hired to edit the original, self-published version of “Shy Girl.” Ballard said she’s pursuing legal action, and that as a result of the controversy “my mental health is at an all time low and my name is ruined for something I didn’t even personally do.”

Advertisement

Writer Lincoln Michel and other industry observers have noted that U.S. publishers rarely do extensive editing when they acquire titles that have already been published in other forms.

Source link

Continue Reading

Tech

iPhone 18 Pro could level up its camera game with Halide-inspired features

Published

on

Apple may be preparing a major upgrade for the iPhone’s camera, and this time, it’s not just about hardware. According to The Information, Apple explored acquiring Lux Optics, the studio behind the popular Halide camera app, as part of its efforts to improve the iPhone 18 Pro’s camera experience.

The talks reportedly took place in 2025 but didn’t result in a deal. Still, the intent is clear: Apple wants its default Camera app to catch up with pro-level tools, especially as its hardware continues to improve.

Why is Apple suddenly focusing on camera software?

Let’s be real, hardware alone isn’t enough anymore. Apple’s upcoming iPhone 18 Pro is expected to push closer to professional-grade camera hardware, but that also raises the bar for software. Right now, many advanced users rely on third-party apps like Halide to unlock manual controls, RAW shooting, and deeper exposure adjustments.

Halide, in particular, is known for offering precise manual control over iPhone camera hardware, something Apple’s default app still lacks. By potentially integrating similar features directly into iOS, Apple could eliminate the need for third-party apps and make pro-level photography more accessible to everyday users.

What does this mean for iPhone users?

Apple hasn’t confirmed anything yet, but the direction is pretty obvious. If Halide’s influence kicks in, the iPhone could get manual focus, exposure controls, advanced RAW capture, long-exposure shots, and pro-level video tools. Basically, turning the Camera app from “tap and pray” to “dial it in like a pro.”

What makes this more interesting is that Halide co-founder Sebastiaan de With is now at Apple, which feels less like a coincidence and more like a soft rollout of ideas. The iPhone camera might soon think a little less like Apple… and a little more like a photographer. For users, this could be a big shift. Instead of jumping to third-party apps for serious shooting, the default Camera app might finally do it all. And if Apple gets the balance right, the iPhone 18 Pro could stop playing catch-up and start setting the pace again.

Advertisement

Source link

Continue Reading

Tech

Today’s NYT Connections: Sports Edition Hints, Answers for March 22 #545

Published

on

Looking for the most recent regular Connections answers? Click here for today’s Connections hints, as well as our daily answers and hints for The New York Times Mini Crossword, Wordle and Strands puzzles.


For today’s Connections: Sports Edition, the purple category came to me right away, and it’s usually the toughest. I also got a kick out of the green category. If you’re struggling with today’s puzzle but still want to solve it, read on for hints and the answers.

Connections: Sports Edition is published by The Athletic, the subscription-based sports journalism site owned by The Times. It doesn’t appear in the NYT Games app, but it does in The Athletic’s own app. Or you can play it for free online.

Advertisement

Read more: NYT Connections: Sports Edition Puzzle Comes Out of Beta

Hints for today’s Connections: Sports Edition groups

Here are four hints for the groupings in today’s Connections: Sports Edition puzzle, ranked from the easiest yellow group to the tough (and sometimes bizarre) purple group.

Yellow group hint: Same-same.

Advertisement

Green group hint: Otto, Anna.

Blue group hint: He ain’t heavy…

Purple group hint: The DMZ is one.

Answers for today’s Connections: Sports Edition groups

Yellow group: All square.

Advertisement

Green group: Palindromes.

Blue group: NBA brothers, past and present.

Purple group: ____ zone.

Read more: Wordle Cheat Sheet: Here Are the Most Popular Letters Used in English Words

Advertisement

What are today’s Connections: Sports Edition answers?

completed NYT Connections: Sports Edition puzzle for March 22, 2026

The completed NYT Connections: Sports Edition puzzle for March 22, 2026.

The yellow words in today’s Connections

The theme is all square. The four answers are deadlocked, even, level and tied.

The green words in today’s Connections

The theme is palindromes. The four answers are kayak, pop, radar and stats.

Advertisement

The blue words in today’s Connections

The theme is NBA brothers, past and present. The four answers are Antetokounmpo, Ball, Curry and Gasol.

The purple words in today’s Connections

The theme is ____ zone. The four answers are 2-3, neutral, red and strike.

Source link

Advertisement
Continue Reading

Tech

Today’s NYT Mini Crossword Answers for March 22

Published

on

Looking for the most recent Mini Crossword answer? Click here for today’s Mini Crossword hints, as well as our daily answers and hints for The New York Times Wordle, Strands, Connections and Connections: Sports Edition puzzles.


Need some help with today’s Mini Crossword? It’s not too tough, but 7-Across made me stop and start thinking of five-letter beverage brands. Read on for all the answers. And if you could use some hints and guidance for daily solving, check out our Mini Crossword tips.

If you’re looking for today’s Wordle, Connections, Connections: Sports Edition and Strands answers, you can visit CNET’s NYT puzzle hints page.

Advertisement

Read more: Tips and Tricks for Solving The New York Times Mini Crossword

Let’s get to those Mini Crossword clues and answers.

completed-nyt-mini-crossword-puzzle-for-march-22-2026.png

The completed NYT Mini Crossword puzzle for March 22, 2026.

Advertisement

NYT/Screenshot by CNET

Mini across clues and answers

1A clue: Jost of “Saturday Night Live”
Answer: COLIN

6A clue: German wine valley whose name rhymes with “wine”
Answer: RHINE

7A clue: Big name in root beer
Answer: AANDW

Advertisement

8A clue: Common slot machine symbol
Answer: FRUIT

9A clue: James Talarico’s state
Answer: TEXAS

Mini down clues and answers

1D clue: Cunning skill
Answer: CRAFT

2D clue: Chicago airport
Answer: OHARE

Advertisement

3D clue: Operating system on which Android is partly based
Answer: LINUX

4D clue: World’s most populous country
Answer: INDIA

5D clue: Small salamanders
Answer: NEWTS

Advertisement

Source link

Continue Reading

Tech

Samsung’s upcoming Galaxy foldables could get a charging speed boost

Published

on

Samsung’s next generation of foldable phones could bring some changes to charging, though not all of them might be what fans are hoping for. According to recent certification listings spotted via SammyGuru, upcoming devices like the Galaxy Z Fold 8 and a new “Wide Fold” variant have appeared on China’s 3C database, hinting at potential updates to charging capabilities.

These listings typically reveal wired charging specs ahead of launch, making them an early indicator of what to expect. But here’s the catch: the “upgrade” might not be as big as it sounds.

What do the leaks actually reveal?

Two upcoming devices, SM-F9710 and SM-F9760, are believed to be the Chinese variants of the Galaxy Z Fold 8 and a new “Galaxy Z Wide Fold.” These listings show support for 15V at 3A charging, which translates to 45W wired charging. If accurate, that would mark a noticeable jump over previous Fold models, which have typically been limited to 25W wired charging.

However, a separate listing for what’s believed to be the Galaxy Z Flip 8 shows 9V at 2.77A (~25W) charging, essentially unchanged from its predecessor. So while the Fold lineup may finally see a boost, the Flip series appears to be sticking with the same charging speeds for now.

How big of an upgrade is this?

For the Fold lineup, this is actually a meaningful upgrade. Samsung has stuck with 25W charging for years, so moving to 45W would finally bring it closer to its Galaxy S Ultra devices and noticeably cut down charging times. That said, these numbers only apply to wired charging, as 3C listings don’t reveal wireless speeds.

For buyers, this is a welcome but uneven improvement. The Fold 8 and Wide Fold could see a solid boost, while the Flip 8 may remain unchanged, creating a clear divide in the lineup. It’s a step in the right direction, but not quite the full upgrade many were hoping for. Especially when you already have players like OnePlus and other Chinese brands that go well beyond 100W.

Advertisement

Source link

Continue Reading

Tech

Tesla’s Terafab Brings Manufacturing Power to Match the Scale of Space

Published

on

Elon Musk Terafab Tesla Largest Chip Factory
Elon Musk made a game-changing announcement hours ago when he revealed plans for Tesla’s Terafab during a live event, taking its work on vehicles and robots literally out of this world. The initiative is a game changer, bringing together SpaceX and xAI to create the world’s largest chip factory. The sheer scale of the operation is mind-boggling, since Terafab will be capable of producing 1 trillion watts of finished chips every year, all under one gigantic roof that will house logic circuits, memory storage, and final packaging.



All of this is important because we desperately need a reliable mechanism to generate solar energy that can be beamed back from space. Terafab is specifically built to accomplish just that. We’re talking about launching an incredible 100 million tons of capture equipment into orbit EVERY YEAR. To accomplish this, we must be able to move millions of tons of material year after year. Once in orbit, solar-powered satellites will conduct all of the AI heavy lifting, with millions of Tesla Optimus robots on hand to erect and maintain those structures well above the good old earth.

Each of those Optimus robots is a significant undertaking, as they require between 100 and 200 billion watts of chips just to function. When you factor in the satellites, you can see the tremendous demand we’re talking about: trillions of watts of chips that no existing chip manufacturer can possibly offer, at least not yet. According to projections, we will have the same shortage until 2030.


That is where Terafab comes in, since it is specifically designed to bridge that gap, with the kind of huge capacity that has the ability to overcome the hurdles that have been holding back both ground-based robot fleets and processing power in orbit. To get it erected, the construction team will use established launch techniques to transport the enormous cargo into place. To get the factory up and running, robots that are already in development will take on assembly tasks that are simply too dangerous for humans to do on a regular basis. As a result, we will have a consistent supply of chips to meet our rising requirements on Earth and beyond.

Advertisement

The driving factor behind all of this is a strong desire to explore the universe, not just envision what’s out there, but to experience it firsthand. As one of the speakers put it, “understanding comes only from direct experience out there in the universe,” and Terafab is the first step in translating that idea into something concrete, something that anyone can track, from the start of creation to the end of delivery.

Advertisement

Source link

Continue Reading

Tech

Reworked Apple Watch avoids ban, but Masimo battle escalates

Published

on


The decision, made public on Thursday, concludes that Apple’s latest implementation of pulse-oximetry functionality falls outside the scope of Masimo’s asserted rights. The full ITC commission will now review the judge’s ruling and decide whether to adopt it – a step that will determine whether the redesigned watches remain protected…
Read Entire Article
Source link

Continue Reading

Tech

Daily Deal: The 2026 C# Course Bundle

Published

on

from the good-deals-on-cool-stuff dept

The 2026 C# Course Bundle offers 8 courses that cover everything C#. You’ll master the fundamentals, explore object-oriented programming, and start building your own apps in no time. It’s on sale for $40.

Note: The Techdirt Deals Store is powered and curated by StackCommerce. A portion of all sales from Techdirt Deals helps support Techdirt. The products featured do not reflect endorsements by our editorial team.

Filed Under: daily deal

Source link

Advertisement
Continue Reading

Tech

‘We should regard it as a privilege to be stepping stones to higher things’: How Arthur C Clarke predicted the rise of AGI and the looming demise of humanity back in 1964

Published

on

While debate over the timeline – or even the potential – for artificial general intelligence (AGI) rages on in 2026, one futurist may have predicted the breakthrough more than 60 years ago.

Noted British science fiction writer and futurist Arthur C. Clarke touted the arrival of AGI during an interview at the 1964 World’s Fair in New York City.

Source link

Continue Reading

Tech

This monitor claims paper-like viewing and huge energy savings by using ambient light instead of relying entirely on traditional backlighting

Published

on


  • Hannspree Hybri monitor uses ambient light to significantly reduce energy consumption
  • Reflective display design aims to mimic paper-like readability and comfort
  • Automatic switching enables backlight use in low ambient light conditions

The Hannspree Hybri monitor attempts to merge paper-like readability with modern display performance, claiming an 80% reduction in energy use through innovative use of ambient light.

At illumination levels above 1000lux, common in offices, classrooms, and outdoor-adjacent spaces, the monitor reflects surrounding light instead of relying solely on a backlight.

Source link

Advertisement
Continue Reading

Trending

Copyright © 2025