LiteLLM says it believes the malicious litellm 1.82.7 and 1.82.8 releases on PyPI began with the Trivy scanner used in its build pipeline. That is a belief, not a confirmed finding. PyPI separately says the packages were compromised through a mutable reference in their use of the Trivy GitHub Action. The question for a buyer is which pipeline tools can see the keys that publish code.
How did a scanner end up linked to a package release?
Aqua, the maintainer of Trivy, says that on 19 March 2026 an attacker used compromised credentials to publish a malicious Trivy v0.69.4 release. It also says 76 of the 77 version tags of the trivy-action GitHub Action were moved to credential-stealing malware, and that the stealer ran before the real scan.
On 24 March 2026 LiteLLM published its own post. It says the incident may be linked to the wider Trivy compromise, where stolen credentials were reportedly used to reach its publishing pipeline. LiteLLM also says evidence suggests a maintainer PyPI account may have been compromised, and that the attacker appeared to bypass official CI/CD workflows and upload packages directly to PyPI. The GitHub advisory and PyPI both describe an API token exposure from an exploited Trivy dependency.
Our pages on the LiteLLM PyPI supply chain incident and the Trivy GitHub Actions incident hold the full records. Here we follow the chain.
- Scanner tamperedAqua says 76 of 77 trivy-action tags were moved to credential-stealing malware.Technique T1195.002 (MITRE ATT&CK, opens in a new tab)
- Secrets readThe stealer swept more than 50 file paths for SSH keys, cloud credentials and Kubernetes tokens.
- Publishing path reachedLiteLLM says stolen credentials were reportedly used to reach its publishing pipeline.
- Normal workflow bypassedLiteLLM says the attacker appeared to upload packages directly to PyPI.
- Install runs the stealerPyPI says the malware ran on install.
How long were the bad LiteLLM versions available?
Sources differ, so we show each one as written. LiteLLM says the packages were live from 10:39 UTC on 24 March 2026 for about 40 minutes before PyPI quarantined them. The same post defines the affected window as pip installs between 10:39 UTC and 16:00 UTC. PyPI reports 1h 19m from upload to the first report, 1h 12m from that report to quarantine, and a total exposure time of 2h 32m. PyPI also says the affected versions were downloaded over 119k times during the attack window.
Why did pinning decide who was hit?
LiteLLM says customers running its official Proxy Docker image were not impacted because it pins dependencies. It also says unpinned installs, including transitive dependencies of other tools, could pull the bad versions. PyPI says LiteLLM is typically installed about 15-20 million times per week and estimates that roughly 40-50% of installs were unpinned.
The same lesson appears upstream. Aqua says trivy-action 0.35.0 was not affected because GitHub immutable releases protected it. Aqua and CERT-EU both recommend pinning GitHub Actions to full SHA hashes rather than mutable tags. PyPI recommends dependency cooldowns, lock files with hashes, and Trusted Publishers over long-lived API tokens. For another GitHub Actions case, see our page on the tj-actions supply chain incident.
What should you ask about your own pipeline?
If either bad version ran, LiteLLM advises treating all credentials on affected systems as compromised and rotating them. The stealer was designed to scan for environment variables, SSH keys, cloud credentials, Kubernetes tokens and database passwords. Use these questions as a start.
- Which tools can see our secrets?Aqua says all secrets reachable by an affected pipeline must be treated as exposed.
- Are actions pinned by full hash?Aqua and CERT-EU recommend full SHA hashes over mutable tags.
- Do installs use lock files and a cooldown?PyPI recommends lock files with hashes and dependency cooldowns.
- Do we use long-lived publishing tokens?PyPI recommends Trusted Publishers over long-lived API tokens.
- Do we rotate everything together?Aqua says its first rotation was not atomic, so the attacker may have kept access.
For hosts, LiteLLM lists litellm_init.pth in site-packages and traffic to the attacker domains named in its advisory as indicators of compromise.
Could threat intelligence monitoring have given early warning?
It might have, with no promise. Monitoring can watch for exposed credentials tied to your company, alerts about compromised packages you depend on, and reports naming groups. CERT-EU attributes the Trivy, LiteLLM and Telnyx compromises to the cybercrime actor TeamPCP.
The public record shows several moments to ask about. Aqua opened its public incident discussion on 20 March 2026, four days before LiteLLM’s post. A public GitHub issue reporting a malicious litellm_init.pth in 1.82.8 was opened on 24 March. PyPI received 13 inbound malware reports. CISA added the Trivy CVE-2026-33634 to its Known Exploited Vulnerabilities catalog on 26 March. Ask whether anyone on your team would have seen the first of these before the packages reached your build servers.
Related reading: TanStack worm: CI questions every team should ask and Nx Console and GitHub: dev tools as an entry path.
Last checked against sources on 9 October 2026.