The supply chain attack attributed to the threat actor TeamPCP initially compromised Aqua Security's Trivy scanner, which was used to scan container images. This upstream compromise allowed malicious code to be executed automatically when infected packages were fetched, enabling the harvesting of credentials, tokens, API keys, and other secrets. The attackers leveraged stolen developer secrets to modify and publish malicious package versions downstream, including two poisoned LiteLLM package versions published on March 24, which were active for about 40 minutes. The attack propagated through six major CI/CD platforms and affected over 2,500 organizations globally. Analysis shows that over 95% of the affected organizations were exposed before the LiteLLM packages were published, indicating that the Trivy compromise was the primary vector. The stolen secrets include JWT tokens, private keys, AWS keys, GitLab tokens, OpenAI API keys, Slack webhooks, GitHub Actions tokens, and Google API keys. The stolen data is already being brokered by threat actors.

The attack resulted in widespread exposure of sensitive credentials and secrets across more than 2,500 organizations, enabling potential unauthorized access to critical systems and services. The compromise affected multiple CI/CD platforms, increasing the risk of further downstream supply chain contamination. The exposure of developer identities and machine tokens increases the risk of persistent and stealthy attacks. The stolen secrets are actively being brokered, raising the likelihood of subsequent exploitation or secondary attacks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Organizations should verify the integrity of their Trivy scanner installations and any related dependencies. They should also rotate all potentially exposed secrets, including tokens, keys, and credentials, especially those used in CI/CD pipelines. Monitoring for unauthorized access using compromised credentials is recommended. Since the malicious LiteLLM packages were active only briefly and the main compromise vector was Trivy, remediation efforts should prioritize addressing the Trivy compromise and securing developer environments. Follow vendor advisories from Aqua Security and related package registries for updates and official fixes.