LiteLLM-trivy hack fallout: stolen keys still haunt 2,500 firms

The initial breach stemmed from a sophisticated compromise of the Trivy vulnerability scanner’s GitHub Actions pipeline by the threat actor group TeamPCP, exploiting a vulnerable pull_request_target workflow as early as February 27, 2026. This allowed the attackers to harvest organization- and repository-level credentials, including incompletely revoked automation tokens that persisted for about 20 days despite rotation efforts, granting them sustained privileged access. By weaponizing a poisoned dependency within Trivy, the attackers injected a stealthy 105-line malicious code block into LiteLLM’s CI/CD pipeline, transforming downstream runners into credential-collection points that silently exfiltrated secrets before legitimate scans could run.

Leveraging the compromised Trivy scanner, TeamPCP gained legitimate read access to LiteLLM’s CI/CD runner environment, enabling them to stealthily exfiltrate PyPI publishing tokens and inject malicious versions 1.82.7 and 1.82.8 of the LiteLLM package. These tainted releases, available on PyPI for roughly 40 minutes, executed payloads immediately upon Python interpreter initialization using a.pth startup hook, harvesting environment variables and installing persistent backdoors. This rapid breach execution exposed sensitive credentials—including cloud keys, SSH keys, Kubernetes tokens, and AI provider API keys—from approximately 434,000 CI/CD pipelines across over 2,500 organizations, impacting major firms like AWS, NVIDIA, Salesforce, Samsung, and Cisco.

The LiteLLM-Trivy supply chain breach of early 2026 rapidly compromised over 2,500 organizations and approximately 434,000 CI/CD pipelines within a mere 40 minutes, marking it as the largest AI infrastructure attack identified that year. Attackers exploited a poisoned dependency in Aqua Security’s Trivy scanner, inserting a malicious 105-line Python startup hook that executed immediately upon Python interpreter initialization. This hook stealthily harvested environment variables, configuration files, and installed persistent backdoors, enabling the silent exfiltration of highly sensitive credentials including AWS, Google Cloud, Azure keys, SSH keys, Kubernetes tokens, and AI-specific API keys across major firms like AWS, NVIDIA, Salesforce, Samsung, and Cisco.

Despite swift removal of the tainted LiteLLM package versions 1.82.7 and 1.82.8 from PyPI, the breach’s impact endured due to incomplete credential revocation and surviving compromised automation identities. Security firms CloudSEK and Hudson Rock analyzed a staggering 153GB archive containing over 433,000 leaked files from nearly 119,000 CI runner dumps across 2,488 corporate domains, revealing that many stolen credentials remained active months after the incident. This persistence underscores a systemic identity-containment failure, where automation tokens and CI/CD workflow permissions allowed attackers to maintain access and lateral movement, posing ongoing risks until all secrets are rotated and downstream activity thoroughly investigated.

The breach exposed a critical vulnerability in automated dependency management within modern software supply chains, as highlighted by the FBI’s July 2026 FLASH advisory warning that harvested credentials could be weaponized for future attacks. The attackers’ initial foothold stemmed from exploiting a vulnerable pull_request_target workflow in Trivy’s GitHub Actions pipeline as early as February 27, 2026, enabling silent exfiltration of PyPI publishing tokens and subsequent malicious package releases. This long-tail credential exposure event not only compromised organization- and repository-level secrets but also demonstrated how incomplete remediation efforts can leave supply chains dangerously exposed to persistent and evolving threats.

Attribution challenges further complicated response efforts, as many leaked files contained highly sensitive secrets like active database passwords and cloud credentials without clear organizational markers. Investigations revealed misattributions such as the SiriusXM pipeline breach actually belonging to its subsidiary AdsWizz, emphasizing the need for deeper infrastructure analysis beyond surface-level committer emails. This ambiguity leaves numerous organizations potentially unaware of their compromised status, amplifying the breach’s systemic impact across the AI and cloud ecosystem.

The FBI's official advisories following the LiteLLM-Trivy supply chain breach have spotlighted a persistent and troubling security challenge: stolen credentials remain valid months after the initial compromise, posing ongoing risks to over 2,500 affected firms including giants like AWS, NVIDIA, and Salesforce. These alerts emphasize that simply removing compromised packages is insufficient, as the underlying authentication materials continue to grant attackers access, necessitating immediate and comprehensive credential rotation to mitigate further exploitation.

Compounding the remediation complexity, security experts and the FBI stress the indispensable role of forensic investigations to fully understand the breach's scope. Organizations are urged to prioritize probing whether the compromised packages were executed and what credentials were accessible during that execution, as confirmed execution significantly elevates the threat level. This investigative rigor is crucial because valid credentials can maintain downstream system access even after the malicious software is eradicated, underscoring the enduring nature of the threat and the intricate challenges in achieving complete breach containment.

On 26 August 2026, two Western Australian men were formally charged following a meticulous joint investigation by the Australian Federal Police, Western Australia Police Force, and the FBI, targeting the cybercriminal group TeamPCP responsible for a sweeping open-source software supply-chain attack. The charges, which include possession and modification of data with intent to commit computer offences and dealing with proceeds of crime exceeding $100,000, carry penalties of up to 20 years imprisonment, underscoring the gravity of the breach that impacted over 1,000 organizations globally.

This case exemplifies the critical role of international law enforcement collaboration in tackling sophisticated cyber threats, with FBI Cyber Division Assistant Director Brett E. Leatherman emphasizing that the partnership with Australian authorities showcased the necessity of a coordinated global response to the escalating menace of software supply-chain attacks. The investigation revealed how the compromise of a small number of trusted open-source components could cascade into widespread disruption across multiple sectors and jurisdictions, highlighting urgent challenges for supply chain security governance worldwide.