Poisoned Trivy and LiteLLM releases steal developers' cloud credentials (TeamPCP, CVE-2026-33634)
Attackers poisoned Trivy (19 March) then LiteLLM 1.82.7/1.82.8 on PyPI (24 March) to steal cloud keys and secrets. Anyone who ran them or the altered Trivy actions should update and rotate every reachable secret. Little direct risk to home users.
If you or your IT team use Trivy, its GitHub Actions or LiteLLM from PyPI, check for the bad versions, move to safe ones, and rotate every secret those systems could reach. Otherwise nothing for you to do.
- litellmno fixed version yet
What’s happening
On 19 March 2026 a group calling itself TeamPCP used credentials left over from an earlier, incompletely cleaned-up breach to publish a malicious Trivy 0.69.4 release and to rewrite most version tags of Aqua's trivy-action and setup-trivy GitHub Actions. The code harvested cloud, SSH, Kubernetes, CI/CD and package-registry secrets. Aqua removed the artefacts within hours and published safe versions, but the attacker returned on 22 March with malicious Docker images and leaked Aqua's internal repositories. Secrets stolen from Trivy users' pipelines let attackers publish LiteLLM 1.82.7 and 1.82.8 to PyPI on 24 March; they were quarantined and deleted the same day. LiteLLM says its Cloud service and official Docker image were not affected. A Checkmarx GitHub Action was also compromised. Aqua and LiteLLM report no sign commercial products or core code were altered. No arrests or charges were found. Affected users must rotate every secret those systems could reach.
- What
- Poisoned software
- Affects
- Trivy scanner and GitHub Actions (Aqua Security); LiteLLM Python package
- Affected
- Trivy binary v0.69.4
Trivy Docker Hub images 0.69.5 and 0.69.6
trivy-action: 76 of 77 version tags altered on 19 March (only v0.35.0 untouched)
setup-trivy: multiple version tags altered
LiteLLM 1.82.7 and 1.82.8 on PyPI
Checkmarx kics-github-action (compromised separately) - Fixed in
- Trivy 0.69.2 to 0.69.3 (safe)
trivy-action v0.35.0 (safe)
setup-trivy v0.2.6 (safe)
LiteLLM 1.82.7 and 1.82.8 removed from PyPI; no specific safe version named in the sources read - Since
- 19 Mar 2026
- Closed
- 1 Apr 2026
Timeline
- All clear
Aqua said its investigation with Sygnia was nearly finalised and that it still saw no sign its commercial products were affected. No arrests or charges were found in searches up to early November 2026.
- Update
LiteLLM published its post-incident update: it rotated secrets, paused releases, brought in Mandiant for forensics, and found no malicious code pushed to its main branch and no evidence of movement into internal systems.
- Wider attacksFixed
Malicious LiteLLM 1.82.7 and then 1.82.8 were published to PyPI using credentials stolen through the Trivy compromise. LiteLLM says they were live about 40 minutes before PyPI quarantined them and had been deleted by 16:00 UTC; Kaspersky puts the exposure at about five hours.
- Wider attacks
Wiz Research identified a parallel compromise of the Checkmarx kics-github-action. Kaspersky reports Checkmarx code was cleaned up about three hours later.
- Wider attacksPartly fixed
Malicious Trivy Docker Hub images 0.69.5 and 0.69.6 appeared and Aqua's internal repositories were made public on GitHub, showing the attacker had regained access. Wiz also reports an npm worm called CanisterWorm using stolen publish tokens.
- New fixFixed
Aqua published safe versions (Trivy 0.69.2 to 0.69.3, trivy-action v0.35.0, setup-trivy v0.2.6), guidance and indicators of compromise.
- Made publicPartly fixed
Attackers pushed a malicious Trivy v0.69.4 release and force-pushed trivy-action and setup-trivy version tags to malicious code. Aqua says trivy-action had 76 of 77 tags altered (only v0.35.0 untouched); Wiz counts 75 of 76. Aqua contained the attack at about 20:38 UTC and removed the malicious artifacts.
- Made public
Aqua says Trivy disclosed an earlier incident from late February, in which attackers abused a misconfigured GitHub Actions setup to get a privileged token. Credential rotation that followed was incomplete, so the attacker kept some access.
Sources
- Trivy Supply Chain Attack: What You Need to KnowAqua Security · 1 Apr 2026
- Security townhall updatesLiteLLM · 27 Mar 2026
- Trivy compromised: TeamPCP supply chain attackWiz · 24 Mar 2026
- Supply chain attack via Trivy and LiteLLMKaspersky · 26 Mar 2026