Trivy and LiteLLM Compromised: 2,100+ Organizations Exposed via…

TeamPCP compromised the CI/CD pipelines of Trivy and LiteLLM between March 19 and March 24, 2026. Six confirmed breaches hit European institutions and Fortune 500 firms, with over 4 TB of data exfiltrated.

On March 19, 2026, TeamPCP forced the release of Trivy v0.69.4 with malicious code, opening a breach in CI/CD pipelines that enabled the compromise of LiteLLM five days later and the potential exposure of more than 2,100 organizations. Six high-profile breaches are already confirmed — including the European Commission, Cisco, and S&P Global — with exfiltration exceeding 4 TB of data, source code, and credentials. The campaign demonstrates that trust in security tools themselves has become the most dangerous blind spot in cloud-native infrastructure.

Key Takeaways

On March 19, 2026, TeamPCP forced 76 of 77 trivy-action tags and all 7 setup-trivy tags to malicious commits that harvested credentials.
On March 24, 2026, LiteLLM versions 1.82.7 and 1.82.8 remained on PyPI for approximately 40 minutes with a payload that executed at Python startup via a .pth file, not at import time.
The European Commission confirmed the exfiltration of 91.7 GB compressed (340 GB uncompressed) from its AWS account, with attribution to TeamPCP at "high confidence" according to CERT-EU.
CloudSEK mapped a dataset of approximately 434,000 files linked to the potential exposure of 2,500+ organizations, explicitly stating the figure does not equal a count of confirmed victims.

The Compromise Mechanism: Non-Atomic Rotation and Exposure Window

The entry point was the Trivy GitHub repository, a widely adopted open-source container vulnerability scanner in CI/CD pipelines. According to advisory GHSA-69fq-xp46-6x23, between 18:22 and 21:42 UTC on March 19, 2026, attackers forced the publication of 76 of 77 tags in the trivy-action repository and all 7 tags in the setup-trivy repository. The tags pointed to commits containing credential-harvesting malware.

The critical mechanism that amplified the impact was the non-atomic nature of secret rotation. After the initial disclosure on March 1, many organizations began rotation procedures that left valid tokens exposed during the transition window. TeamPCP exploited this window to acquire still-functional credentials, then reused them for the force-push on March 19.

The payload in the Trivy repository operated on filesystem paths and process memory. The GitHub advisory documents access to /proc/<pid>/mem and over 50 filesystem paths, with hybrid AES-256-CBC and RSA-4096 encryption. The primary exfiltration channel was direct; as a fallback, data was uploaded to GitHub repositories controlled by the actor with the tpcp-docs prefix.

LiteLLM and Execution Outside Import: The Hidden Payload

The compromise of LiteLLM, an open-source AI gateway for orchestrating language models, revealed a more insidious persistence technique. The malicious versions 1.82.7 and 1.82.8, published on PyPI on March 24, 2026, from 10:39 to 16:00 UTC — approximately 40 minutes of exposure — contained a litellm_init.pth file. This file exploited Python's standard mechanism for automatic execution at interpreter startup, not at module import.

The distinction is technically significant: execution at Python startup means the payload activates in any process that launches the interpreter, regardless of whether the code explicitly imports LiteLLM. This includes transitive dependencies, environment startup scripts, and system tools that share the Python interpreter. According to Endor Labs analysis cited by The Hacker News, the payload operated in three stages with credential collection from the LiteLLM environment.

The PyPA advisory framed the warning in stark terms: "Anyone who installed and ran the project must assume that any credential available in the litellm environment may have been exposed."

The Six Confirmed Victims: From Government Institutions to Fortune 500

Six breaches are documented with specific details and primary or direct intelligence sources. The European Commission is the victim with the strongest official attribution: CERT-EU confirmed with "high confidence" that initial access occurred via the Trivy supply chain, with AWS secret acquisition on March 19, 2026, and exfiltration of 91.7 GB compressed, equivalent to 340 GB uncompressed. The data was published by ShinyHunters on March 28, 2026.

Cisco suffered theft of source code from more than 300 GitHub repositories, including customer code and AI product projects (AI Assistants, AI Defense), according to anonymous sources cited by BleepingComputer. The company proceeded with system reimaging and credential rotation.

Guesty recorded extortion for 700 GB of data including 4 million emails and integration data with Airbnb and Booking.com. S&P Global suffered exfiltration of 250 GB comprising thousands of secrets, GitHub tokens, JWTs, and RSA private keys. Mercor suffered the largest extraction: approximately 4 TB total, of which 939 GB was source code, with biometric data and SSNs of more than 40,000 contractors; Meta suspended its contract with the company and class-action lawsuits were initiated. Lapsus$ claimed the sale of data to Chinese enterprises, a claim that remains independently unverified.

Telnyx published malicious versions 4.87.1 and 4.87.2 of its Python SDK on PyPI on March 27, 2026, but stated that its platform, APIs, and customer data were not compromised.

"These companies were built to protect your supply chains yet they can't even protect their own" — TeamPCP Telegram message

The Discovery Network: CloudSEK, FBI, and the Warning on Prolonged Weaponization

CloudSEK acquired a dataset of approximately 434,000 files and logs, mapping matches with potential exposure for 2,500+ organizations. The company explicitly clarified that the number reflects potential exposure, not a count of confirmed victims. The Hacker News reported the figure of 2,100+ organizations in its headline, which may represent a subset of the CloudSEK dataset with higher confidence of match.

The FBI issued FLASH-20260702-01 warning of the long-term weaponization of compromised credentials and recommending CI/CD secret rotation. The alert confirms the campaign is assessed as active and ongoing. Endor Labs concurred: "This campaign is almost certainly not over...each compromised environment yields credentials that unlock the next target."

Hudson Rock completed more than 250 ethical disclosures, including more than 30 S&P 500 or Fortune 500 companies, with evidence from the Cavalier portal.

Immediate Actions

Verify whether pipelines ran with Trivy v0.69.4, trivy-action, or setup-trivy with forced tags, or with LiteLLM 1.82.7/1.82.8 from PyPI between March 19 and March 24, 2026.
Rotate all credentials exposed to the affected CI/CD environments, including GitHub tokens, cloud keys, and application secrets, without assuming the initial post-March 1 rotation was effective.
Inspect Python installations for unauthorized .pth files, particularly litellm_init.pth, which executes at interpreter startup.
Monitor for the presence of GitHub repositories with the tpcp-docs prefix in outbound connection history, an indicator of the fallback channel documented in the advisory.

The Collapse of the Trust Chain

The TeamPCP campaign is not an isolated product vulnerability: it demonstrates that the trust chain in open-source dependencies has become a systemic risk. Trivy was the tool organizations used to scan for vulnerabilities; its compromise opened a direct channel into build and release pipelines. LiteLLM was the infrastructure for managing access to AI models; its compromise exposed environments with elevated privileges on inference services.

Gal Nagli of Wiz summarized the dynamic: "Trivy gets compromised → LiteLLM gets compromised → credentials from tens of thousands of environments end up in attacker hands → and those credentials lead to the next compromise. We are stuck in a loop." The loop does not break with point patches, but with a rethinking of the assumption of trust toward any dependency with mutable tags.

Information has been verified against cited sources and is current as of publication.

Sources

Sources and references