Trivy compromise, not LiteLLM, linked to 2,500+ exposures
SOCRadar says most of the 2,500+ organizations tied to the LiteLLM incident were exposed earlier by a compromised Trivy scanner that spread malicious libraries and stole secrets.
SOCRadar’s investigation found that most of the more than 2,500 organizations reported in the LiteLLM incident were first exposed after a compromised Aqua Security Trivy scanner build. The firm traces the campaign to a malicious Trivy build published on March 19 that distributed a worm-like loader and harvested secrets, with poisoned LiteLLM packages appearing on PyPI on March 24 as a later step.
The firm reconstructed per-organization records for 2,188 entities. The earliest activity in that set appears on March 19 at 18:05 UTC and the latest on March 24 at 20:09 UTC. SOCRadar reports credential collection began about 18 minutes after the malicious Trivy build was published. For 2,085 organizations in the sample, or 95%, data collection activity had already ended before the March 24 PyPI entries were published. SOCRadar wrote, “The 40 minutes everyone reported was the closing act, not the whole play.”
According to the analysis, malicious Trivy images hosted on Docker Hub delivered a loader that executed automatically, collected tokens and keys, and propagated to downstream systems. The versions of LiteLLM that appeared on PyPI on March 24 contained an injected .pth file that Python executes at interpreter startup, allowing code to run without importing the package and bypassing ignore-scripts protections. SOCRadar added, “[This] is what persistence on already-infected hosts looks like: the .pth payload kept running after the source of the infection was gone.”
The malware targeted a wide range of secrets and CI environments. More than 1,000 organizations in the dataset had exposed JWT or authentication tokens. Hundreds of organizations showed private keys, AWS access keys, GitLab tokens, OpenAI API keys, Slack webhooks, GitHub Actions tokens, and Google API keys. The highest secret counts in the reconstructed records were roughly 3,477 and 3,459; one record carried about 3,459 secrets across six files. Committer email addresses were captured across more than 1,100 organizations.
The incident affected multiple continuous-integration platforms, including GitHub Actions, GitLab CI, Jenkins, Bitbucket, CircleCI, and Buildkite. SOCRadar identified Germany, Brazil and France as the most affected countries in its sample. The firm emphasized that its numbers reflect a reconstructed sample rather than a complete census and that 56% of the 2,188 organization records are rated high confidence, 39% medium, and 6% low.
SOCRadar links the activity to a threat actor that has used similar worm-like payloads in other open source supply-chain attacks. The firm reported that stolen credential collections are already being circulated; one actor is offering a combined dataset of LiteLLM, Trivy and CanisterWorm data on Telegram.
SOCRadar’s timeline and attribution indicate the Trivy compromise began on March 19 and preceded the March 24 PyPI packages, and the firm attributes most of the exposures in its sample to the earlier Trivy incident.
Articles by this author
