Blaming The Wrong Tool Again, Splendid

In what is just another Tuesday in IT, some 2,500 organisations suffered exposure thanks to Trivy rather than malicious LiteLLM packages. Over 95% of these lovely victimised companies were already compromised before the malicious packages even showed up, proving once again our uncanny ability to be breached ahead of schedule. Protecting infrastructure from this mess means actually monitoring supply chain scanners properly, though expecting anyone to audit their security tooling seems delightfully optimistic.