Trivy Scanner, Not LiteLLM, Was Primary Vector in 2,500-Organization Compromise
New analysis suggests the widespread compromise impacting over 2,500 organizations was primarily caused by an earlier exploit of the Trivy scanner, not the malicious LiteLLM packages.
Recent cybersecurity investigations into a widespread supply chain attack that affected over 2,500 organizations have revealed a crucial distinction: the primary vector of compromise was not the malicious LiteLLM packages, but rather an earlier exploitation of the Trivy security scanner. This finding, reported by SOCRadar, shifts the focus from the short-lived LiteLLM compromise to a more persistent threat originating from the Trivy vulnerability.
The attack, initially attributed to the threat actor TeamPCP known for multiple open-source software (OSS) supply chain compromises, utilized a worm-like mechanism. The compromised Trivy scanner, a popular tool for identifying vulnerabilities in container images and code repositories, propagated malicious code downstream. This code was automatically executed when infected packages were fetched and run, leading to the harvesting of sensitive credentials, tokens, and API keys. The worm's ability to use stolen developer secrets to modify accessible packages and push malicious versions to registries amplified its reach.
While two poisoned LiteLLM package versions were published on March 24, 2026, and remained online for approximately 40 minutes, SOCRadar's analysis of compromise data indicates that the majority of affected organizations were compromised before this window. The malicious packages injected a .pth file, which Python automatically executed at interpreter startup, even if LiteLLM was not imported, bypassing certain security protections.
SOCRadar examined records for 2,188 entities, including timestamps and credential types. The earliest data collection activity was recorded on March 19, 2026, just 18 minutes after the malicious Trivy build was published on Docker Hub. Activity surged on March 22 and 23, coinciding with the presence of malicious Trivy images on Docker Hub, and concluded on March 24 after the LiteLLM packages were quarantined by PyPI. This timeline strongly suggests that the persistent threat was the Trivy compromise, with the LiteLLM packages acting as a later, albeit still dangerous, component.
The compromised Trivy images were live on Docker Hub for a significant period, allowing the malware to spread widely. The .pth payload, once installed, continued to run even after the original source of infection was removed, demonstrating a sophisticated persistence mechanism. This allowed attackers to continue exfiltrating data long after the initial exploit.
The attack targeted six major CI/CD platforms: GitHub Actions, GitLab CI, Jenkins, Bitbucket, CircleCI, and Buildkite. Organizations across the globe were impacted, with Germany, Brazil, and France experiencing the highest rates of exposure. The harvested secrets included a wide array of sensitive information, with JWT and authentication tokens being the most common, followed by private keys, AWS access keys, GitLab tokens, OpenAI API keys, and Google API keys.
Compounding the issue, committer email addresses were compromised in over 1,100 organizations, giving attackers both developer identities and machine tokens. This comprehensive access allows for deeper infiltration and more sophisticated attacks. The stolen information is already being brokered on underground forums, with one threat actor offering data compiled from the LiteLLM, Trivy, and CanisterWorm campaigns.
This incident underscores the critical importance of scrutinizing all software supply chain components, including development tools and scanners. The widespread impact highlights the interconnectedness of the software development ecosystem and the cascading effects of a single compromised tool. Organizations must implement robust security practices, including dependency scanning, vulnerability management, and least-privilege access controls, to mitigate the risks posed by such sophisticated supply chain attacks.