Trivy Supply Chain Attack Hit 2,500 Orgs Before LiteLLM

A SOCRadar investigation has revealed that the widely reported LiteLLM supply chain attack, blamed for compromising more than 2,500 organizations, was largely a misattribution. According to the cybersecurity firm, the actual point of origin was Aqua Security's Trivy container scanner, with the LiteLLM incident representing only the closing act of a campaign orchestrated by TeamPCP—the threat actor behind the Shai-Hulud worm. The worm-like malware propagated downstream through poisoned packages and repositories, automatically harvesting credentials, API tokens, CI/CD secrets, and other sensitive material from infected developer environments.

SOCRadar's analysis of per-organization records covering 2,188 entities found that timestamps, credential types, CI/CD platforms, and domain data pointed overwhelmingly to the earlier Trivy compromise rather than the March 24 LiteLLM package incident. "Every record carries first-seen and last-seen timestamps. The earliest is March 19 at 18:05 UTC and the latest is March 24 at 20:09 UTC, a span of just over five days," the firm noted. For 2,085 organizations—roughly 95% of identified victims—data exfiltration activity ceased well before the poisoned LiteLLM versions were published to PyPI. The earliest credential harvest occurred just 18 minutes after the malicious Trivy build was pushed, with activity surging on March 22 and 23 when weaponized Trivy images remained live on Docker Hub. Malicious LiteLLM packages exploited a .pth file that Python executes at interpreter startup, bypassing ignore-scripts protections and persisting on already-infected hosts even after the upstream source was quarantined.

The campaign spanned six CI/CD platforms—GitHub Actions, GitLab CI, Jenkins, Bitbucket, CircleCI, and Buildkite—with Germany, Brazil, and France reporting the highest concentration of affected organizations. Stolen developer secrets were brokered and used to push further malicious package versions to accessible registries, dramatically expanding the attack surface. Given the breadth of this supply chain compromise, developers and security teams should immediately verify whether their credentials have appeared in known breaches using an email breach checker, rotate any exposed tokens, and audit installed Trivy and LiteLLM builds against IOC lists. Organizations should also run a password checker against secrets stored in CI/CD pipelines and CI environments to identify weak or previously leaked credentials that could be exploited in follow-on attacks. A full privacy checkup across developer workstations is recommended to confirm no residual persistence mechanisms remain.