A poisoned vulnerability scanner sat inside a widely-trusted build pipeline for five days before anyone noticed, and Cisco, S&P Global and the European Commission are on the list of who it touched.
In March 2026, the AI proxy tool LiteLLM shipped two poisoned PyPI packages that stayed live for about 40 minutes before PyPI pulled them. That's the version of this story that made headlines when it broke in August. It's also, according to a corrected timeline researchers published this week, the least important part of what happened. The real breach started five days earlier, inside a tool built specifically to catch vulnerabilities before they ship: the open-source scanner Trivy.
It wasn't LiteLLM's fault. It was the tool watching for vulnerabilities.
Trivy is Aqua Security's open-source vulnerability scanner, embedded in thousands of build pipelines including LiteLLM's own. TeamPCP exploited a pull_request_target misconfiguration in Trivy's GitHub Actions workflow starting March 19, stealing a privileged personal access token in the process. That token gave them legitimate-looking access to Trivy's build runners for roughly 20 days before anyone caught it — five days of which happened before LiteLLM was even involved.
Because LiteLLM ran Trivy inside its own CI pipeline, the poisoned scanner — deploying malware researchers describe as part of the Shai-Hulud worm family — had a direct path to LiteLLM's publishing credentials. On March 24, attackers used those stolen credentials to push two backdoored LiteLLM releases, versions 1.82.7 and 1.82.8, straight to PyPI. Microsoft's own Azure and Teams patches this quarter faced a similarly frantic timeline; we covered three separate perfect-10 flaws Microsoft rushed to fix before Patch Tuesday even landed.
Researchers at InfoStealers cross-referenced the leaked data against public breach disclosures and found at least six large organizations with confirmed downstream damage. The pattern is the same in every case: a CI runner holding live cloud credentials that don't expire just because nobody's watching them.
Confirmed downstream breaches
Cisco
Organization
Source code, GitHub personal access tokens, Artifactory and Conjur secrets
S&P Global
Organization
250GB of internal projects, AWS STS tokens, RSA private keys
European Commission
Organization
AWS IAM admin access, hardcoded SSH keys, GitLab CI tokens
Docker credentials; two malicious PyPI SDK versions republished under its name
Telnyx's case is the one that should worry developers specifically: attackers didn't just steal from Telnyx, they used stolen credentials to publish two malicious versions of Telnyx's own Python SDK (4.87.1 and 4.87.2) back onto PyPI, turning one victim into a distribution vector for the next one. It's the same worm mechanic — one supply-chain breach seeding another — this site flagged in the npm Keyv incident a few weeks back.
What to actually do about it
1
Check whether Trivy ran anywhere in your CI pipeline between March 19–24, 2026 — not just whether you use LiteLLM directly.
2
Rotate every credential a compromised runner could see in that window: cloud keys, Git tokens, SSH keys, AI provider API keys — not just the ones you remember using.
3
Audit package-publish logs for unexpected releases in that window, the way Telnyx's malicious SDK versions slipped out unnoticed.
4
Assume brokered data is still circulating — the FBI's July advisory says stolen credentials from this incident are still being sold months later.
CI/CD pipelines routinely hold live cloud credentials — which is exactly what made this breach spread so far. · Unsplash
Was LiteLLM itself hacked, or just its packages?
LiteLLM's own infrastructure wasn't the entry point. Attackers compromised Trivy's GitHub Actions pipeline first, then used stolen credentials to push two poisoned LiteLLM packages (1.82.7 and 1.82.8) to PyPI on March 24, 2026.
How long were the malicious LiteLLM packages live?
About 40 minutes before PyPI quarantined them. That number is misleading on its own, though — most of the 2,188 documented victims were exposed through the earlier Trivy compromise, not the LiteLLM window.
Is Trivy safe to use now?
Aqua Security has closed the specific GitHub Actions misconfiguration attackers used, but no full public post-incident audit from Aqua had been published as of this writing.
What should I do if my org used Trivy or LiteLLM in March 2026?
Rotate every credential exposed to CI runners in the March 19–24 window, not just ones tied directly to LiteLLM, and check your package-publish logs for anything you didn't push yourself.
Expect more names to surface. CloudSEK's dataset runs to 2,188 organizations at medium-to-high confidence, and researchers say stolen data is still being brokered on Telegram this month. If you're running a serious CI pipeline in 2026, treat every third-party scanner and linter the way you'd treat a contractor with root access — because as of March, that's exactly what one turned out to be.
