'Trivy, Not LiteLLM, Behind the 2,500-Org Compromise' Ran Yesterday. We Published That Chain on April 1 — With One Word We Got Wrong.
- Patrick Duggan
- 3 minutes ago
- 4 min read
SecurityWeek published a piece on August 14 titled "Trivy, Not LiteLLM Behind the 2,500 Org Compromise." The correction it carries is that TeamPCP never targeted LiteLLM directly — LiteLLM was compromised because its CI pipeline automatically installed the poisoned Trivy version.
We published that chain on April 1, 2026, in a post called "One Actor, Three Supply Chains: How TeamPCP Chained Trivy, LiteLLM, and Telnyx Into a Single Kill Chain."
This post is both halves of that: the receipt, and the one word in ours that was wrong.
What we said in April
The April 1 post opens on the origin, with the date and the count:
"On March 19, someone poisoned 76 of 77 release tags in Aqua Security's Trivy-Action GitHub repository. The credential stealer ran silently inside CI/CD pipelines — the security scanner stealing secrets from the infrastructure it was trusted to protect. Five days later, malicious versions of LiteLLM appeared on PyPI. Same actor. Different package."
So four and a half months ago we had the origin (Trivy, not LiteLLM), the date (March 19), the mechanism of the initial compromise (poisoned release tags), the sequencing (LiteLLM five days later), the actor (TeamPCP), and the framing that these were one chain rather than three incidents — which is the entire thesis of yesterday's headline, and it is in our title.
That is a publication-date claim, not an ingest-timestamp claim. Both posts are public and dated, so you can check it in a browser rather than taking our word, which is the only kind of lead worth stating.
The word we got wrong
"Same actor. Different package."
That sentence implies TeamPCP chose LiteLLM and attacked it deliberately, as a second operation. Per CloudSEK's analysis, that is not what happened. They never targeted LiteLLM at all. LiteLLM's CI pipeline installed the compromised Trivy automatically, the credential stealer harvested from that pipeline, and the poisoned LiteLLM releases followed from what it took.
We had the chain right and the intent wrong. We described a deliberate second strike where the reality was automated collateral.
The distinction is not cosmetic, and it cuts in the more alarming direction. A deliberate campaign against three named targets is bounded — the attacker picked them, and you can reason about why. Automated propagation is not bounded by anything except who installed the poisoned tool. More than 430,000 CI/CD pipelines pulled it. LiteLLM was not selected; it was simply one of the projects whose automation reached out and took the malware on schedule.
The correct mental model is closer to the Shai-Hulud worm behaviour we wrote about this morning with ChainDrop than to a targeted campaign. TeamPCP is the actor behind both, and the through-line is now clear: they compromise one high-trust upstream, and the ecosystem's own automation distributes it for them.
Why the scanner was the perfect first domino
Trivy is the most widely adopted open-source scanner in the cloud-native ecosystem. On March 19 the attacker poisoned its GitHub Actions, its release binaries, and its Docker Hub images simultaneously, injecting a credential stealer into every official distribution channel at once.
Consider what a vulnerability scanner is, structurally. It runs early in the pipeline, before anything is trusted. It runs with broad read access, because it has to see everything to scan everything. It runs on nearly every build, because that is the point of it. And nobody scans the scanner, because the scanner is the thing that does the scanning.
It is the single highest-privilege, lowest-suspicion position in a modern build. We wrote in April that it was "the security scanner stealing secrets from the infrastructure it was trusted to protect," and four months on that is still the cleanest description of the problem.
This is the same shape as our security-vendor-as-attack-surface pattern: the products we install to reduce risk sit in positions of exceptional trust, and that trust is itself the asset.
What this is worth, stated honestly
We were early on the chain and we were public about it, and the field has now converged on the same conclusion. That is the good half.
The other half is that we did not discover any of it. The Trivy compromise was found and disclosed by others; the LiteLLM mechanism was pinned down by CloudSEK; SecurityWeek did the work of putting the correction in front of people. We connected published pieces into a chain earlier than most, kept a structured TeamPCP profile so the connection was cheap to make, and got one word wrong doing it.
Our July field-map post also claimed we had "LiteLLM flagged forty-five days early." Given what we now know about the mechanism, that flag was of a downstream symptom rather than the cause. It was still useful to anyone consuming the feed — the poisoned versions were the thing you needed to not install — but we should not let it imply we understood the propagation path at the time. We did not.
The lesson we are keeping
When one incident follows another by days and shares an actor, the intuitive read is a campaign. The boring read is automation, and the boring read is now correct twice in one week — Trivy to LiteLLM in March, and ChainDrop republishing 444 npm packages from one stolen token this month.
Assume propagation before you assume intent. If you are trying to work out why a particular project got hit, check what its pipeline installs before you theorise about why an attacker would want it.
Ninety-five percent, as always — and this post is the correction, so if the mechanism turns out different again we will write that one too.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.
Was this useful? Thirty seconds, no cookies, no tracking, no third parties, your address hashed and never stored. If the box below does not load, the same question lives at https://analytics.dugganusa.com/nps.html?post=trivy-not-litellm-behind-the-2-500-org-compromise-ran-yesterday-we-published-that-chain-on-apri
Comments