A massive supply chain attack has left thousands of organizations vulnerable to cyber threats, with a surprising twist: most of the compromised systems were actually infected by a previous vulnerability in a popular security scanner, rather than the original malware. According to SOCRadar’s analysis, more than 2,500 organizations were likely affected by the LiteLLM attack, but the majority of them had already been compromised through Aqua Security’s Trivy scanner.
The Trivy compromise started with a malicious build being published on March 19, which automatically executed code when infected packages were fetched and run. This allowed the attackers to harvest credentials, tokens, API keys, and other secrets from affected organizations. The worm-like behavior of the malware then spread downstream to multiple packages and repositories, further compromising the security of connected systems.
What’s more, this is not an isolated incident. TeamPCP, the threat actor behind the LiteLLM attack, has been linked to multiple open source software supply chain attacks involving the Shai-Hulud worm. The group follows a predictable pattern: they inject malicious code into packages and repositories, which then propagates to other connected systems. This allows them to expand their attack surface and compromise even more organizations.
The compromised data includes sensitive information such as JWT tokens, auth tokens, private keys, AWS access keys, and API keys from various services like OpenAI, Slack, and Google. In some cases, the attackers have also managed to steal committer email addresses, giving them both developer identities and machine tokens. This stolen information is already being brokered on Telegram by one threat actor.
SOCRadar’s analysis reveals that 95% of the identified organizations had their data collection activity end before March 24, when the poisoned LiteLLM packages were published to the registry. Instead, it appears that the earliest collection occurred 18 minutes after the malicious Trivy build was published on March 19. The data suggests that persistence on already-infected hosts allowed the malware to continue running even after the source of infection was gone.
The compromised organizations span across multiple continents, with Germany, Brazil, and France being among the most affected countries. This incident highlights the importance of keeping software supply chains secure and regularly updating packages and dependencies. It also underscores the need for more robust security measures, such as monitoring for suspicious activity and implementing robust access controls.
As a practical takeaway, it’s essential to review your organization’s security posture and ensure that all connected systems are up-to-date with the latest patches and updates. Regularly scan your software dependencies using reputable tools like Trivy or similar alternatives, and monitor for any suspicious activity on your networks. By staying vigilant and proactive in securing our digital infrastructure, we can minimize the impact of these types of attacks and safeguard against future threats.
Source: SecurityWeek — 2026-08-14