A Complex Web of Compromise: Unraveling the TeamPCP Attack on 2,500 Organizations
In a shocking revelation, it appears that most of the 2,500 organizations affected by the LiteLLM supply chain attack were actually exposed through a compromise involving Aqua Security’s Trivy scanner, not LiteLLM itself. This twist highlights the intricate and interconnected nature of modern software development and deployment pipelines.
The TeamPCP threat actor has been behind multiple open-source software (OSS) supply chain attacks, including the notorious Shai-Hulud worm. In this case, the malware spread rapidly through a ripple effect fueled by its worm-like behavior and automated inclusion in more builds. Over 2,500 organizations worldwide were likely affected, with Germany, Brazil, and France being the most impacted.
The compromise started with Trivy, which is used to scan for vulnerabilities in software dependencies. When infected, Trivy would automatically execute malicious code when fetching and running the infected package, harvesting sensitive credentials, tokens, API keys, and other secrets in the process. The worm also used stolen developer secrets to modify accessible packages and push the malicious versions to the registry, expanding its reach.
In a peculiar twist, LiteLLM was itself compromised through a malicious .pth file that Python automatically executed at interpreter startup, even if LiteLLM was never imported. This bypassed ignore-scripts protections, allowing the malware to persist on infected hosts long after the source of the infection had been removed.
A close examination of the incident data revealed per-organization records for 2,188 entities, including timestamps, credential types, CI/CD platforms, and domains. The earliest collection activity occurred just 18 minutes after the malicious Trivy build was published, with a surge on March 22 and 23 when malicious Trivy images were live on Docker Hub.
The compromised data includes sensitive information such as JWT and auth tokens, private keys, AWS access keys, GitLab tokens, OpenAI API keys, Slack webhooks, GitHub Actions tokens, and Google API keys. Over 1,000 organizations exposed JWT and auth tokens alone, with some exposing multiple types of secrets across just a few files or repositories.
The stolen information is already being brokered on Telegram, where one threat actor is offering a collection of LiteLLM, Trivy, and CanisterWorm data likely compiled at various stages of the campaign. This highlights the critical need for organizations to secure their software development pipelines and protect sensitive credentials from compromise.
In light of this incident, it’s essential for developers and security teams to scrutinize their OSS dependencies, monitor their CI/CD platforms, and regularly update their security protocols to prevent similar attacks in the future.
Source: SecurityWeek — 2026-08-14