This analysis relies on Hudson Rock data — not independently verifiable — and the technical timeline from SOCRadar. On March 19, 2026, TeamPCP, tracked by Google Mandiant as UNC6780, force-pushed Trivy tags to malicious commits. Five days later, poisoned LiteLLM versions landed on PyPI. According to Hudson Rock, six enterprise breaches resulted, with an exposure window SOCRadar quantifies at 95% before public repository publication.
- The malware used a
.pthfile that executed at Python startup, without requiring a LiteLLM import. - Aqua Security rotated credentials on March 1, 2026, but the rotation was not atomic: residual tokens remained valid until the March 19 force-push.
- CVE-2026-33634, with CVSS 8.8 HIGH, was added to the CISA KEV catalog on March 26, 2026.
- Hudson Rock has completed over 250 ethical disclosures, including over 30 S&P 500/Fortune 500 groups, from a 153 GB RAR archive containing 118,829 CI dumps.
How a Scanner Became the Entry Point
On February 27-28, 2026, TeamPCP exploited the pull_request_target directive in Trivy's GitHub Actions workflow to infiltrate the CI pipeline. On March 1, Aqua Security rotated the compromised credentials, but the operation was not atomic: residual tokens remained valid.
On March 19 at 17:43 UTC, attackers force-pushed 76 of 77 trivy-action tags and all 7 setup-trivy tags to malicious commits. Four minutes later, at 17:47 UTC, Trivy 0.69.4 was built and published. Subsequent versions (0.69.5 and 0.69.6) arrived on Docker Hub on March 22.
LiteLLM, which installed Trivy in its workflows without version pinning, incorporated the compromised scanner. On March 24 at 10:39 UTC, version 1.82.7 landed on PyPI; at 10:52 UTC, version 1.82.8 followed with the addition of litellm_init.pth. This Python startup hook eliminated the import requirement: the payload activated automatically at interpreter startup.
PyPI quarantined both releases around 11:19 UTC, roughly 40 minutes after the first publication. According to SOCRadar, 95% of exposed organizations had already been reached in the preceding five days.
"95% of affected organizations were already exposed before March 24, when the packages went live. The 40 minutes on PyPI closed a collection race that had already been running for five days." — SOCRadar
The Payload and Attack Surface
The malware collected cloud keys, SSH tokens, Kubernetes credentials, database passwords, secrets from .env files, and keys for AI providers — including OPENAI_API_KEY and ANTHROPIC_API_KEY. Exfiltration targeted the domain models.litellm[.]cloud, controlled by the attackers.
LiteLLM receives approximately 3.4 million daily downloads. Reconstructed exposure figures converge across SOCRadar, CloudSEK (via The Hacker News), and SecurityWeek: roughly 434,000 CI files captured and over 2,500 organizations. CloudSEK qualified these numbers as "reconstructed exposure, not confirmed victim count."
Hudson Rock, from its Cavalier platform, obtained a 153 GB RAR archive with 433,909 files and 118,829 CI dumps attributed to 2,488 corporate domains.
Six Breaches, Six Different Impact Profiles
Hudson Rock analyzed six cases with specific details, noting that "these breaches were extremely difficult to avoid. The affected organizations are not at fault." The technical specifics below reflect Hudson Rock's assertions, not independent confirmations from the organizations involved.
Guesty: According to Hudson Rock, 700 GB of data extorted, 4 million emails sent and received, integration data with Airbnb and Booking.com. The Vect ransomware group listed the company on its leak site.
S&P Global: According to Hudson Rock, 250 GB exfiltrated, thousands of secrets including GitHub tokens, JWTs, and RSA private keys. Here too, Vect claimed the attack.
Cisco: According to Hudson Rock, source code stolen from the cisco-it-cloud-infrastructure repository via poisoned Trivy container; exposed GitHub PATs, Artifactory tokens, and Conjur API key.
European Commission: According to Hudson Rock, AWS IAM credentials, hardcoded private SSH key, and compromised GitLab CI tokens. CERT-EU assessed AWS account compromise with high confidence and quantified exfiltrated data at approximately 91.7 GB (compressed).
Mercor: According to Hudson Rock, approximately 4 TB extracted total, including 939 GB of proprietary source code. SSN and biometric data of over 40,000 contractors exposed. Meta suspended its data-sharing contract with the company; class-action lawsuits initiated. Lapsus$ claimed to have sold Mercor data to Chinese firms, a claim that remains independently unverifiable.
Telnyx: Malicious versions 4.87.1 and 4.87.2 of the Python SDK published on PyPI on March 27, 2026. Exposed Docker configurations with base64-encoded credentials and GitHub PATs. Telnyx stated that its platform, APIs, and customer data were not compromised.
What to Do Now
The following actions are limited to what is documented in primary sources.
Check for compromised versions: Review build logs for installation of LiteLLM 1.82.7 or 1.82.8, Trivy 0.69.4-0.69.6, or Telnyx SDK 4.87.1/4.87.2. The CVE-2026-33634 record lists affected CPEs in the NVD database.
Check for known exfiltration: The domain models.litellm[.]cloud is documented as an exfiltration destination. Its presence in network logs indicates contact with attacker infrastructure.
Assess CI/CD exposure: SOCRadar found that 95% of exposure occurred before the March 24 PyPI window. Organizations with pipelines that installed Trivy without version pinning between March 19-24, 2026 face documented compromise risk.
Consider source limitations: Specific breach details (data volumes, secret categories) come from Hudson Rock, a single-vendor platform with data not independently verifiable. Reconstructed exposure figures (2,500+ organizations, 434K files) do not equal confirmed victim counts.
The Detail That Changes the Reading
The 13-minute gap between the two PyPI releases is the most significant technical detail. Version 1.82.7 required an application to import LiteLLM to trigger the payload. Version 1.82.8 added litellm_init.pth, eliminating even that requirement. As SOCRadar noted, "the 13 minutes between the two releases is the detail to keep in mind."
This evolution within the same publication window indicates attackers were optimizing the attack surface in real time, not deploying a static payload.
The TeamPCP/UNC6780 campaign required no zero-day vulnerability in LiteLLM source code, but rather the insertion of a malicious artifact into an already compromised pipeline. The distinction matters for risk assessment: the failure point was the build process, not the AI gateway design.
Sources: Hudson Rock/Infostealers.com; SOCRadar; The Hacker News/CloudSEK; SecurityWeek; NVD CVE-2026-33634; Mandiant/Google Cloud Community.
Information verified against cited sources and current as of publication.
Sources
- https://www.infostealers.com/article/from-ci-pipeline-to-ransomware-breaches-6-high-profile-breaches-in-the-litellm-trivy-attack/
- https://www.infostealers.com/article/largest-ai-supply-chain-breach-of-2026-litellm-hack-impacts-thousands-of-global-enterprises-claim-your-ethical-disclosure/
- https://socradar.io/blog/litellm-supply-chain-attack/
- https://malware.news/t/from-ci-pipeline-to-ransomware-breaches-6-high-profile-breaches-in-the-litellm-triv-attack/124842
- https://nvd.nist.gov/vuln/detail/CVE-2026-33634
- https://security.googlecloudcommunity.com/community-blog-42/protecting-customers-in-record-time-google-security-operations-and-mandiant-s-response-to-the-axios-npm-supply-chain-attack-7321
- https://thehackernews.com/2026/08/malicious-litellm-releases-tied-to.html
- https://www.securityweek.com/over-2500-organizations-impacted-by-litellm-supply-chain-attack/