Trivy Compromise Accounted for Most Exposure Attributed to LiteLLM Attack

Most of the organizations linked to a recent LiteLLM software supply-chain incident appear to have been exposed earlier through a compromise involving the Trivy security scanner, according to an analysis by SOCRadar.

Earlier reports from CloudSEK and HudsonRock estimated that more than 2,500 organizations may have been affected after two malicious LiteLLM package versions were published to PyPI on March 24. SOCRadar’s review of incident records suggests that the LiteLLM packages represented only the final stage of a broader campaign associated with TeamPCP, a threat actor linked to attacks involving the Shai-Hulud worm.

Timeline points to Trivy

SOCRadar examined records connected to 2,188 organizations, including collection timestamps, affected secrets, domains and CI/CD platforms. Activity was recorded from March 19 through March 24. For 2,085 organizations—approximately 95% of the identified set—data collection ended before the malicious LiteLLM packages were released.

The earliest observed collection began 18 minutes after a malicious Trivy build appeared on March 19. Activity increased on March 22 and March 23, while tainted Trivy images were available on Docker Hub, and continued after the LiteLLM packages were quarantined. Researchers said this pattern is consistent with a payload persisting on already infected systems rather than with a compromise limited to the brief LiteLLM publication window.

The LiteLLM packages contained a Python .pth file capable of executing automatically when an interpreter started, even when the package itself was not imported. That behavior could also bypass protections designed to block package installation scripts.

Secrets and developer identities exposed

The campaign targeted credentials and other sensitive data across GitHub Actions, GitLab CI, Jenkins, Bitbucket, CircleCI and Buildkite environments. More than 1,000 organizations reportedly exposed JWTs or authentication tokens. Other captured data included private keys, AWS access keys, GitLab and GitHub tokens, OpenAI API keys, Slack webhooks and Google API keys.

Committer email addresses were also exposed at more than 1,100 organizations, potentially giving attackers both developer identities and machine credentials. SOCRadar cautioned that its figures represent exposure estimates from a reconstructed dataset, not confirmed intrusions or a complete victim census.

The stolen information is reportedly being advertised on Telegram in collections that include data associated with Trivy, LiteLLM and CanisterWorm, suggesting that compromised secrets may already be circulating among other threat actors.