{"id":"trivy-litellm-supply-chain-credential-theft-mar-2026","category":"supply-chain","status":"closed","title":"Poisoned Trivy and LiteLLM releases steal developers' cloud credentials (TeamPCP, CVE-2026-33634)","tldr":"Attackers poisoned Trivy (19 March) then LiteLLM 1.82.7/1.82.8 on PyPI (24 March) to steal cloud keys and secrets. Anyone who ran them or the altered Trivy actions should update and rotate every reachable secret. Little direct risk to home users.","summary":"On 19 March 2026 a group calling itself TeamPCP used credentials left over from an earlier, incompletely cleaned-up breach to publish a malicious Trivy 0.69.4 release and to rewrite most version tags of Aqua's trivy-action and setup-trivy GitHub Actions. The code harvested cloud, SSH, Kubernetes, CI/CD and package-registry secrets. Aqua removed the artefacts within hours and published safe versions, but the attacker returned on 22 March with malicious Docker images and leaked Aqua's internal repositories. Secrets stolen from Trivy users' pipelines let attackers publish LiteLLM 1.82.7 and 1.82.8 to PyPI on 24 March; they were quarantined and deleted the same day. LiteLLM says its Cloud service and official Docker image were not affected. A Checkmarx GitHub Action was also compromised. Aqua and LiteLLM report no sign commercial products or core code were altered. No arrests or charges were found. Affected users must rotate every secret those systems could reach.","action":"If you or your IT team use Trivy, its GitHub Actions or LiteLLM from PyPI, check for the bad versions, move to safe ones, and rotate every secret those systems could reach. Otherwise nothing for you to do.","product":"Trivy scanner and GitHub Actions (Aqua Security); LiteLLM Python package","audience":"work","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2026-33634"],"tags":["supply-chain","trivy","litellm","pypi","github-actions","teampcp","credential-theft","aqua-security"],"affected":["Trivy binary v0.69.4","Trivy Docker Hub images 0.69.5 and 0.69.6","trivy-action: 76 of 77 version tags altered on 19 March (only v0.35.0 untouched)","setup-trivy: multiple version tags altered","LiteLLM 1.82.7 and 1.82.8 on PyPI","Checkmarx kics-github-action (compromised separately)"],"fixed":["Trivy 0.69.2 to 0.69.3 (safe)","trivy-action v0.35.0 (safe)","setup-trivy v0.2.6 (safe)","LiteLLM 1.82.7 and 1.82.8 removed from PyPI; no specific safe version named in the sources read"],"matches":[{"platform":"pypi","app":"litellm","bundle":"litellm","fixed":""}],"sources":[{"kind":"advisory","title":"Trivy Supply Chain Attack: What You Need to Know","url":"https://www.aquasec.com/blog/trivy-supply-chain-attack-what-you-need-to-know/","by":"Aqua Security","date":"2026-04-01"},{"kind":"advisory","title":"Security townhall updates","url":"https://docs.litellm.ai/blog/security-townhall-updates","by":"LiteLLM","date":"2026-03-27"},{"kind":"research","title":"Trivy compromised: TeamPCP supply chain attack","url":"https://www.wiz.io/blog/trivy-compromised-teampcp-supply-chain-attack","by":"Wiz","date":"2026-03-24"},{"kind":"news","title":"Supply chain attack via Trivy and LiteLLM","url":"https://www.kaspersky.com/blog/critical-supply-chain-attack-trivy-litellm-checkmarx/55510/","by":"Kaspersky","date":"2026-03-26"}],"started":"2026-03-19","closed":"2026-04-01","created":"2026-11-03T21:36:01.471Z","updated":"2026-11-03T21:36:01.471Z","cve_notes":[{"cve":"CVE-2026-33634","name":"Trivy supply-chain compromise (poisoned releases)","what":"Kaspersky tracks the March 2026 Trivy compromise, in which attackers distributed a backdoored Trivy release and altered GitHub Action tags to steal credentials, under this identifier; Aqua's own advisory does not cite a CVE.","severity":"critical","cvss":9.4}],"timeline":[{"at":"2026-04-01","added":"2026-11-03T21:32:34.430Z","kind":"all-clear","text":"Aqua said its investigation with Sygnia was nearly finalised and that it still saw no sign its commercial products were affected. No arrests or charges were found in searches up to early November 2026.","url":"https://www.aquasec.com/blog/trivy-supply-chain-attack-what-you-need-to-know/","by":"Aqua Security","patch":null},{"at":"2026-03-27","added":"2026-11-03T21:32:34.430Z","kind":"other","text":"LiteLLM published its post-incident update: it rotated secrets, paused releases, brought in Mandiant for forensics, and found no malicious code pushed to its main branch and no evidence of movement into internal systems.","url":"https://docs.litellm.ai/blog/security-townhall-updates","by":"LiteLLM","patch":null},{"at":"2026-03-24T10:39Z","added":"2026-11-03T21:32:34.430Z","kind":"wider-attacks","text":"Malicious LiteLLM 1.82.7 and then 1.82.8 were published to PyPI using credentials stolen through the Trivy compromise. LiteLLM says they were live about 40 minutes before PyPI quarantined them and had been deleted by 16:00 UTC; Kaspersky puts the exposure at about five hours.","url":"https://docs.litellm.ai/blog/security-townhall-updates","by":"LiteLLM","patch":"patched"},{"at":"2026-03-23","added":"2026-11-03T21:32:34.430Z","kind":"wider-attacks","text":"Wiz Research identified a parallel compromise of the Checkmarx kics-github-action. Kaspersky reports Checkmarx code was cleaned up about three hours later.","url":"https://www.kaspersky.com/blog/critical-supply-chain-attack-trivy-litellm-checkmarx/55510/","by":"Kaspersky","patch":null},{"at":"2026-03-22","added":"2026-11-03T21:32:34.430Z","kind":"wider-attacks","text":"Malicious Trivy Docker Hub images 0.69.5 and 0.69.6 appeared and Aqua's internal repositories were made public on GitHub, showing the attacker had regained access. Wiz also reports an npm worm called CanisterWorm using stolen publish tokens.","url":"https://www.wiz.io/blog/trivy-compromised-teampcp-supply-chain-attack","by":"Wiz","patch":"partial"},{"at":"2026-03-20","added":"2026-11-03T21:32:34.430Z","kind":"new-fix","text":"Aqua published safe versions (Trivy 0.69.2 to 0.69.3, trivy-action v0.35.0, setup-trivy v0.2.6), guidance and indicators of compromise.","url":"https://www.aquasec.com/blog/trivy-supply-chain-attack-what-you-need-to-know/","by":"Aqua Security","patch":"patched"},{"at":"2026-03-19T17:43Z","added":"2026-11-03T21:32:34.430Z","kind":"disclosed","text":"Attackers pushed a malicious Trivy v0.69.4 release and force-pushed trivy-action and setup-trivy version tags to malicious code. Aqua says trivy-action had 76 of 77 tags altered (only v0.35.0 untouched); Wiz counts 75 of 76. Aqua contained the attack at about 20:38 UTC and removed the malicious artifacts.","url":"https://www.aquasec.com/blog/trivy-supply-chain-attack-what-you-need-to-know/","by":"Aqua Security","patch":"partial"},{"at":"2026-03-01","added":"2026-11-03T21:32:34.430Z","kind":"disclosed","text":"Aqua says Trivy disclosed an earlier incident from late February, in which attackers abused a misconfigured GitHub Actions setup to get a privileged token. Credential rotation that followed was incomplete, so the attacker kept some access.","url":"https://www.aquasec.com/blog/trivy-supply-chain-attack-what-you-need-to-know/","by":"Aqua Security","patch":null}],"url":"https://hard.fyi/live/trivy-litellm-supply-chain-credential-theft-mar-2026/","json":"https://hard.fyi/api/live?id=trivy-litellm-supply-chain-credential-theft-mar-2026"}