ThreatWire Covers TeamPCP Supply-Chain Attacks, a Router Ban and Compliance Claims
· 11:25 · Watch on YouTube ↗
Summary
ThreatWire reports TeamPCP supply-chain compromises involving Trivy and light LLM, an FCC plan to ban foreign-made consumer routers, allegations about Delve’s compliance reports, and a reported Cloudflare tracking-script injection.
Key points
- TeamPCP reportedly used compromised credentials to publish malicious Trivy versions on March 19, 2026; the Trivy team removed them from distribution channels.
- A later compromise of a GitHub Action reportedly involved exfiltration of sensitive information, privileged pod creation and malware installation.
- Compromised light LLM versions 1.82.7 and 1.82.8 reportedly harvested SSH tokens, keys, wallets and environment files, moved across Kubernetes clusters, and installed persistent backdoors. The versions were taken down.
- The FCC announced a plan to ban foreign-made consumer routers, citing national-security risks; the presenter says the approved list did not yet include routers.
- An exposé alleges Delve generated fraudulent compliance reports and experienced an information leak. The presenter says the claims and Delve’s response remain unfolding.
- A user reportedly found a Cloudflare Insights tracker injected on a hosted page; a commenter suggested it may come from Cloudflare web analytics. The video says users can turn it off.
Article Details
- Topics
- [00:13] TeamPCP’s reported supply-chain compromises of Trivy, a GitHub Action and light LLM
- [03:37] FCC plan to ban foreign-made consumer routers on national-security grounds
- [06:07] Allegations about Delve’s compliance reports and an information leak
- Report of a Cloudflare Insights tracker injected on a hosted page
Threat Actors
Salt TyphoonThe FCC statement cited in the video says foreign-made routers were involved in cyberattacks by Salt Typhoon targeting vital US infrastructure.Volt TyphoonThe FCC statement cited in the video says foreign-made routers were involved in cyberattacks by Volt Typhoon targeting vital US infrastructure.