[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fKVi86KNF1947BZw2l987yxVNHHOpBpuOC1p-7XycF6U":3},{"article":4,"iocs":55},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":13,"published_at":14,"ingested_at":15,"relevance_score":16,"entities":17,"category_id":32,"category":33,"article_tags":37},"ddf1fc53-3d6a-494c-8d3b-a1aca9de87f0","Trivy, Not LiteLLM Behind the 2,500 Org Compromise","trivy-not-litellm-behind-the-2-500-org-compromise-a26a1b","Over 95% of the affected companies were exposed before the malicious LiteLLM packages were published. The post Trivy, Not LiteLLM Behind the 2,500 Org Compromise appeared first on SecurityWeek.","New analysis suggests that the majority of the 2,500 organizations impacted by the LiteLLM supply chain attack were actually compromised earlier via a vulnerability in Aqua Security's Trivy scanner. The threat actor, TeamPCP, leveraged the Trivy compromise to propagate malware, which then harvested credentials and secrets. While the LiteLLM packages were online for a short period, the data collection activity for most affected organizations ended before LiteLLM's publication, aligning with the Trivy incident timeline.","Trivy scanner compromise, not LiteLLM, led to 2,500 orgs being exposed.","Most of the 2,500 organizations believed to have been affected by the LiteLLM supply chain attack were actually exposed before, SOCRadar reports. The compromise was blamed on and claimed by TeamPCP, the threat actor behind multiple open source software (OSS) supply chain attacks involving the Shai-Hulud worm. It started with Aqua Security’s Trivy scanner and propagated downstream to multiple packages and repositories in a ripple effect fueled by the malware’s worm-like behavior and by the automated inclusion of the malicious libraries in more builds. More than 2,500 organizations were likely affected by the LiteLLM attack, CloudSEK and HudsonRock said earlier this week. According to SOCRadar, most of them were victims of the Trivy compromise, not LiteLLM. All the compromises associated with TeamPCP followed a similar pattern: malicious code was automatically executed when the infected package was fetched and run to harvest credentials, tokens, API keys, and other secrets. Additionally, the worm used stolen developer secrets to modify accessible packages and push the malicious versions to the registry, expanding the attack surface.Advertisement. Scroll to continue reading. This is how LiteLLM was compromised and how two poisoned package versions were published on March 24 and stayed online for roughly 40 minutes. They were injected with a .pth file that Python automatically executed at interpreter startup, even if LiteLLM was never imported, bypassing ignore-scripts protections. The compromise timeframe According to SOCRadar, a close examination of the LiteLLM incident data revealed per-organization records for 2,188 entities, including timestamps, credential types, CI\u002FCD platforms, and domains. “Every record carries first-seen and last-seen timestamps. The earliest is March 19 at 18:05 UTC and the latest is March 24 at 20:09 UTC, a span of just over five days,” the cybersecurity firm notes. For 2,085 organizations, or 95% of the 2,188 that were identified, data collection activity ended before March 24, when the poisoned LiteLLM packages were published to the registry. “That timing lines up with the upstream Trivy compromise rather than the LiteLLM install window. The 40 minutes everyone reported was the closing act, not the whole play,” SOCRadar says. The earliest collection occurred 18 minutes after the malicious Trivy build was published on March 19. The activity surged on March 22 and March 23 when malicious Trivy images were live on Docker Hub, and closed on March 24 after PyPI quarantined the packages. “[This] is what persistence on already-infected hosts looks like: the .pth payload kept running after the source of the infection was gone,” SOCRadar notes. The compromise involved six CI\u002FCD platforms, namely GitHub Actions, GitLab CI, Jenkins, Bitbucket, CircleCI, and Buildkite, and impacted organizations worldwide, with Germany, Brazil, and France affected the most. Stolen, now brokered secrets The malware targeted secrets broadly, but over 1,000 organizations exposed JWT and auth tokens. Hundreds of them exposed private keys, AWS access keys, GitLab tokens, OpenAI API keys, Slack webhooks, GitHub Actions tokens, and Google API keys. “The highest secret count in the set is roughly 3,477 [the organization has not been named], followed by roughly 3,459. Several high-secret rows rest on very few files or repositories. One row carries 3,459 secrets across just six files,” SOCRadar notes. The cybersecurity firm also points out that committer email addresses were compromised across over 1,100 organizations. In those cases, the attackers have both developer identities and machine tokens. “Of the 2,188 organizations in the record-level set, 56% are rated high confidence, 39% medium, and 6% low, with figures rounded. Headline reporting cites 2,500+ organizations; the difference reflects which records carry attributable identifiers,” SOCRadar notes. “High-confidence matches are keyed on CI host identity and legitimate committer domains, meaning whose systems a captured file came from, rather than any observed use of a stolen credential. These are exposure figures rather than confirmed compromises, drawn from a reconstructed sample rather than a complete census,” it continues. The stolen information is already being brokered. One threat actor is offering on Telegram a collection of LiteLLM, Trivy, and CanisterWorm data, likely compiled at various stages of the campaign. Related: Over 400 NPM Packages Infected in ChainDrop Supply Chain Attack Related: North Korean Hackers Target Open Source Developers in Supply Chain Attacks Related: North Korean Hackers Blamed for Mastra NPM Supply Chain Attack Related: Hackers Exploiting Unpatched GeoServer Zero-Day Written By Ionut Arghire Ionut Arghire is an international correspondent for SecurityWeek. Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights. More from Ionut Arghire WordPress 7.0.4 Patches Remote Code Execution VulnerabilityFortinet Patches Authentication Flaws in FortiWeb and FortiManagerCritical VMware vCenter Vulnerability in Attackers’ CrosshairsNightmare Eclipse Drops Windows Zero-Day Exploit ‘ShieldBreak’Mindgard Raises $30 Million to Protect AI SystemsCeva Logistics Operations Disrupted by CyberattackOver 2,500 Organizations Impacted by LiteLLM Supply Chain AttackFresh Windows Zero-Day Exploited in North Korean Cyberattacks Latest News Google Cloud Sets Out Post-Quantum Roadmap With 2029 Readiness Goal1.6 Million Likely Impacted by RingCentral Data BreachOver 1,000 Charities Hit by Beacon CRM Data Breach14,000 Trezor Customers Impacted by Data Breach at ShipMonkHackers Exploiting Unpatched GeoServer Zero-DayAmnesiaStealer macOS Malware Steals Data, Controls Browser SessionsCybersecurity M&A Roundup: 21 Deals Announced in July 2026Adobe Commerce Bug Targeted Immediately After Disclosure Trending Daily Briefing NewsletterSubscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts. Webinar: Rethinking Cyber Defense for AI-Speed Attacks August 18, 2026 Join this live webinar as we explore if detection-first security operations can keep pace with AI, or if it’s time to rethink prevention as the strongest default. Register Virtual Event: CodeSecCon 2026 August 19, 2026 CodeSecCon bridges the gap between dev and security. Discover best practices for secure coding, innovative risk-reduction tools, and safe AI integration to cultivate a true DevSecOps culture. Safely secure your apps! Register People on the MoveErika Dean has been appointed Chief Information Security Officer at Tricentis.C1 has named Jeff St. Clair Chief Revenue Officer.John Opala has joined Ralph Lauren as Chief Information Security Officer.More People On The MoveExpert Insights The AI Governance Gap Is a Leadership Problem: Waiting Won’t Close It Organizations are rushing to implement AI without fully grasping where its legal protections begin and end. (Steve Durbin) Rethinking AI Security: Why CASB and DLP Need an Interaction-Aware Layer Build your strategy around answering these questions to ensure employees use AI productively while keeping sensitive data, IP, and agent behavior within the boundaries set for safe AI use. (Etay Maor) Timeless Compliance: Why Better Questions Beat Bigger Frameworks The best compliance programs aren't the biggest ones. They're the ones built on a short list of questions that can actually be answered, and that still hold true when the models change. (Matt Honea) Is Patching Dead? Vulnerability Management in the Post-Mythos Era You cannot out-patch a machine that writes a working exploit from a vulnerability description in twenty hours. Stop trying to optimize a game you cannot win. (Danelle Au) When Identity Verification Fails: Lessons from a Real-World SIM Swap and Near Account Takeover Identity confidence changes through","https:\u002F\u002Fwww.securityweek.com\u002Ftrivy-not-litellm-behind-the-2500-org-compromise\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2024\u002F12\u002Fblockchain-cryptocurrency-Solana.jpeg","2026-08-14T11:35:23+00:00","2026-08-14T12:00:24.499192+00:00",8,[18,21,23,26,29],{"name":19,"type":20},"Trivy","product",{"name":22,"type":20},"LiteLLM",{"name":24,"type":25},"TeamPCP","threat_actor",{"name":27,"type":28},"Aqua Security","vendor",{"name":30,"type":31},"CI\u002FCD","technology","26b0b636-0e31-4db1-bffb-61bdf9f20a58",{"id":32,"icon":34,"name":35,"slug":36},null,"Supply Chain","supply-chain",[38,40,45,50],{"category":39},{"id":32,"icon":34,"name":35,"slug":36},{"category":41},{"id":42,"icon":34,"name":43,"slug":44},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",{"category":51},{"id":52,"icon":34,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[56],{"type":44,"value":57,"context":58},"Shai-Hulud worm","Threat actor TeamPCP behind the supply chain attack"]