---
title: "From Scanner to Weapon: Inside the Supply Chain Attack That Backdoored the #1 AI Key Management Library"
description: "Vigilant breaks down the Trivy-to-LiteLLM supply chain attack chain step by step. How attackers compromised a vulnerability scanner, stole a PyPI publish token, and backdoored 97 million monthly downloads worth of AI infrastructure. Plus: the 50K-repo scan that found it first."
image: https://vigilantdefense.com/hubfs/litellmteampcp.png
---
[](https://vigilantdefense.com)
[Platform](https://vigilantdefense.com/platform) [Services](https://vigilantdefense.com/services) [Why Vigilant](https://vigilantdefense.com/why-vigilant) [Vigilant Hope](https://vigilantdefense.com/vigilant-hope) [Company](https://vigilantdefense.com/about) [Research](https://vigilantdefense.com/research)
[CyberDNA Login](https://cyberdna.vigilantdefense.com) [Request Demo](https://vigilantdefense.com/contact)
[Platform](https://vigilantdefense.com/platform) [Services](https://vigilantdefense.com/services) [Why Vigilant](https://vigilantdefense.com/why-vigilant) [Vigilant Hope](https://vigilantdefense.com/vigilant-hope) [Company](https://vigilantdefense.com/about) [Research](https://vigilantdefense.com/research)
[CyberDNA Login](https://cyberdna.vigilantdefense.com) [Request Demo](https://vigilantdefense.com/contact)
Vigilant Research
# Threat Intelligence Briefing
Date March 25, 2026
Classification Client Advisory
Threat Level Critical
From Scanner to Weapon: Inside the Supply Chain Attack That Backdoored the #1 AI Key Management Library
97M Monthly downloads at risk
20,265 Repos with the same vuln profile
590M Downstream forks exposed
135 CI/CD VULNS WE FOUND IN LITELLM BEFORE THE ATTACK
[Github](https://vigilantdefense.com/research/tag/github) [CICD](https://vigilantdefense.com/research/tag/cicd) [litellm](https://vigilantdefense.com/research/tag/litellm) [trivy](https://vigilantdefense.com/research/tag/trivy)
Vigilant Research
# Software Supply Chain Attack Escalation: Trivy, LiteLLM, and the 50K-Repo Vulnerability Landscape
March 25, 2026 | Threat Level: **CRITICAL**
Over the past three weeks, a threat actor known as **TeamPCP** has executed a cascading software supply chain attack that represents the most significant CI/CD threat tracked to date. What began as a single compromised GitHub Action has escalated into a multi-hop campaign that has now reached the AI infrastructure layer, compromising the package that manages LLM API keys for organizations worldwide.
This is not theoretical. Three confirmed attacks in three weeks, each using the previous compromise as a stepping stone:
- **March 12 - tj-actions/changed-files:** Attackers compromised a widely-used GitHub Action, injecting code that stole secrets from thousands of CI/CD pipelines
- **March 19 - Aqua Security Trivy:** The same attackers compromised Trivy, one of the most widely-used open-source vulnerability scanners. The tool designed to find security issues became the attack vector
- **March 24 - BerriAI LiteLLM:** LiteLLM, the most popular AI API key management gateway (97 million monthly downloads), was backdoored via its own CI/CD pipeline, which ran the compromised Trivy scanner. Every organization that updated to version 1.82.7 or 1.82.8 had all environment variables, SSH keys, cloud credentials, and AI API keys exfiltrated to an attacker-controlled server
Vigilant anticipated this escalation pattern. Three weeks ago, we completed the **largest CI/CD security scan ever conducted**, scanning the 50,000 most-starred repositories on GitHub. We found that **20,265 repositories (40.6%) have the same class of vulnerability** that enabled this attack chain. The full research is published at [vigilantdefense.com/research](https://www.vigilantdefense.com/research/github-top-50k-repos-cicd-security-scan).
VIGILANT / RESEARCH
How a security scanner
became the weapon
The Trivy-to-LiteLLM attack chain: how attackers turned the most popular vulnerability scanner into a delivery mechanism for backdooring the #1 AI key management library.
THE THREE-HOP CHAIN
March 12
tj-actions
→
March 19
Trivy
→
March 24
LiteLLM
→
Impact
Every AI key in your org
KILL CHAIN
● Step 1: Compromise Trivy
TeamPCP backdoors Aqua Security's open-source vulnerability scanner through its GitHub Action. The tool meant to *find* malware becomes the delivery mechanism.
● Step 2: Trivy runs unpinned in LiteLLM's CI
LiteLLM's build pipeline pulls Trivy from apt with no pinned version. When Trivy was compromised, attacker code ran automatically inside the build.
● Step 3: PyPI publish token stolen
An overly permissive CI token was exfiltrated straight from the GitHub Actions runner. This token had the ability to push new packages to PyPI.
● Step 4: Malicious versions pushed to PyPI
litellm 1.82.7 and 1.82.8 ship a hidden .pth file. It executes at Python start. No import needed. Just having the package installed is enough.
● Step 5: Credential harvesting
The payload collects all environment variables, SSH keys, and cloud credentials, then sends everything to attacker-controlled infrastructure.
● Step 6: Every AI key harvested
LiteLLM is specifically designed to hold and manage API keys for OpenAI, Anthropic, Azure, AWS Bedrock, and every other major LLM provider. The attacker targeted the one package that by definition has access to every AI API key in an organization.
97M
MONTHLY DOWNLOADS AT RISK
20,265
REPOS WITH THE SAME VULN PROFILE
590M
DOWNSTREAM FORKS EXPOSED
WE SCANNED LITELLM BEFORE THIS ATTACK HAPPENED
Our scan of GitHub's top 50K repos flagged **135 CI/CD vulnerabilities** in LiteLLM across 6 categories. Here is what the exposure looked like:
3
Critical vulnerabilities
Expression injection with secret exposure. Direct path to compromise
60
Unpinned GitHub Actions
Any of these can be swapped for malicious code mid-build
22
Overly permissive tokens
The exact class of flaw that handed attackers the PyPI publish key
21
Comment/issue triggers without auth checks
External users can trigger privileged workflows
20
Expression injection in action inputs
Unsanitized inputs that execute attacker-controlled code
9
Network exfiltration in privileged context
Outbound network access from steps with secret access
CONTINUOUS MONITORING
Runner Guard is the free scanner.
ThreatCERT is the enterprise platform behind it.
Continuous CI/CD monitoring, supply chain risk scoring, and real-time alerting correlated with network, DNS, TLS, and dark web intelligence across your entire vendor chain.
[LEARN ABOUT THREATCERT](https://www.vigilantdefense.com/threatcert)
WHY THIS ATTACK IS DIFFERENT
No click required
This was not phishing. The attack was delivered through a routine software update. Any developer who ran pip install --upgrade litellm was compromised automatically.
Security tools were the weapon
The attackers compromised a vulnerability scanner. Organizations that were actively trying to be secure were the ones who got hit.
AI keys are the prize
LiteLLM manages API keys for OpenAI, Anthropic, Azure, AWS, and every other major AI provider. The attacker targeted the one package that has access to every AI API key in an organization.
Transitive dependencies are attack vectors
The compromise was discovered when an MCP plugin pulled LiteLLM as a transitive dependency. Developers who never directly installed it were still exposed.
THE BROADER LANDSCAPE: 50,000 REPOS SCANNED
Vigilant conducted the largest CI/CD security scan ever performed. The numbers speak for themselves:
50,012
REPOS SCANNED
192,776
VULNERABILITIES FOUND
40.6%
VULNERABLE RATE
68%
VULN RATE FOR 50K+ STAR REPOS
SCAN YOURS NOW
brew install Vigilant-LLC/tap/runner-guard
runner-guard scan .
[FROM THE MAKERS OF RUNNER GUARD Get Continuous Protection with ThreatCERT](https://www.vigilantdefense.com/threatcert)
## How the LiteLLM Attack Worked
This attack is a textbook example of a multi-hop supply chain compromise. Each step was deliberate and calculated:
1. Attackers compromised Aqua Security's Trivy vulnerability scanner through its GitHub Action
2. LiteLLM's CI/CD pipeline ran Trivy as part of its build process, pulled without a pinned version
3. The compromised Trivy exfiltrated LiteLLM's PyPI publish token from the CI/CD runner
4. Attackers used the stolen token to push malicious LiteLLM versions (1.82.7, 1.82.8) to PyPI
5. A hidden `.pth` file executes automatically when Python starts. No import needed. Just having the package installed is enough
6. The payload harvested all environment variables, SSH keys, cloud credentials, and AI API keys, then sent everything to attacker infrastructure
## Why This Matters to Your Organization
LiteLLM is not an obscure library. It is the most widely used AI API gateway, with 97 million monthly downloads. It is specifically designed to hold and manage API keys for OpenAI, Anthropic, Azure, AWS Bedrock, and every other major LLM provider. The attacker deliberately targeted the one package that, by definition, has access to every AI API key in an organization.
If your organization uses LiteLLM, or uses any software that depends on LiteLLM as a transitive dependency, you may be affected. The malicious payload was discovered when an MCP plugin running inside a code editor pulled the compromised package as a transitive dependency, meaning developers who never directly installed LiteLLM were still exposed.
**The critical takeaway:** This attack did not require clicking a link, opening an email, or visiting a website. It was delivered through a routine software update. Any organization that ran `pip install --upgrade litellm` in the past 48 hours should assume credential compromise and begin rotation immediately.
## Vigilant's Research: We Found This Pattern Before the Attack
After the tj-actions attack in early March, Vigilant built and open-sourced [Runner Guard](https://www.vigilantdefense.com/resources/runner-guard), a free CI/CD security scanner, and conducted the largest scan of its kind, examining the 50,000 most-starred repositories on GitHub for the exact vulnerability classes that enabled this attack chain.
Our scan of the LiteLLM repository specifically found **135 CI/CD vulnerabilities across 6 rule categories** before this attack occurred. Across the broader dataset of 50,000 repositories, we found **192,776 CI/CD vulnerabilities** affecting **20,265 repositories**, with **590 million downstream forks** inheriting these vulnerable configurations.
The most popular, most trusted projects are the most exposed. Repositories with 50,000+ stars have a 68% vulnerability rate. Vigilant is the first and only organization to conduct research at this scale. The full findings are published at [vigilantdefense.com/research](https://www.vigilantdefense.com/research/github-top-50k-repos-cicd-security-scan).
Continuous Monitoring
Runner Guard Was Built on ThreatCERT
Runner Guard is the free, open-source scanner. ThreatCERT is the enterprise platform behind it: continuous CI/CD monitoring, supply chain risk scoring, and real-time alerting correlated with network, DNS, TLS, and dark web intelligence across your entire vendor chain.
[LEARN ABOUT THREATCERT](https://www.vigilantdefense.com/threatcert)
## Recommended Actions
### Immediate: Next 24 Hours
1. **Check for LiteLLM exposure.** Determine if any system, application, or developer machine in your environment has LiteLLM installed. Check both direct installations and transitive dependencies. If versions 1.82.7 or 1.82.8 are present, assume all credentials on that machine have been compromised.
2. **Rotate all AI API keys and cloud credentials.** If LiteLLM was present in any form, rotate every API key, cloud credential, and SSH key on the affected systems. This includes OpenAI, Anthropic, Azure, AWS, and any other service credentials that were accessible as environment variables.
3. **Freeze all open-source package updates.** Do not update any open-source dependency until it has been verified as safe. This applies to pip, npm, go modules, and any other package manager. The supply chain is actively under attack. Treat every update as potentially hostile until verified.
4. **Review CI/CD pipeline dependencies.** Identify every third-party tool, action, or scanner that runs in your build pipelines. If any are pulled without version pinning or integrity verification, they are a potential entry point for this same attack pattern.
### Near-Term: Next 7 Days
1. **Scan your repositories with Runner Guard.** Vigilant's open-source CI/CD scanner detects the exact vulnerability classes exploited in this attack chain. It is free, takes one command to run, and covers 15 security rule categories including supply chain trust, injection, privilege escalation, and AI agent configuration risks.
$ brew install Vigilant-LLC/tap/runner-guard
$ runner-guard scan .
1. **Scan any third-party open-source project before adoption or update.** Clone the repository locally and run Runner Guard against it before integrating it into your environment. If it has unpinned dependencies, overly permissive tokens, or injection vulnerabilities in its CI/CD pipeline, those are the exact entry points attackers are exploiting right now.
2. **Implement version pinning.** Every GitHub Action, every package dependency, and every tool in your CI/CD pipeline should be pinned to an immutable hash, not a mutable version tag. Tags like `@v3` or `@latest` can be silently redirected to malicious code. SHA pinning is the only reliable defense.
3. **Establish an update verification process.** No open-source package should be updated in production environments without first verifying the new version against known-good checksums, reviewing the changelog for unexpected changes, and scanning the project's CI/CD configuration for vulnerabilities.
## Supply Chain Security Best Practices
- **Do not update any open-source package today without scanning it first.** The supply chain is actively compromised. Treat every update as suspicious until verified.
- **Be careful what you install.** Transitive dependencies are attack vectors. LiteLLM was pulled as a dependency of other packages. Developers who never directly installed it were still compromised.
- **Pin everything.** Mutable version tags are the root cause of this entire attack chain. SHA pinning for GitHub Actions. Lock files with integrity hashes for package managers. No exceptions.
- **Apply least-privilege to CI/CD tokens.** If LiteLLM's PyPI publish token had been scoped to only run during tagged releases with manual approval, the attacker could not have pushed a malicious version from a compromised build step.
- **Monitor for anomalous package behavior.** The LiteLLM compromise was discovered because a developer's machine ran out of RAM from a fork bomb in the payload. Not every compromise will be that obvious. Monitor for unexpected network connections, environment variable access, and file system changes from your dependencies.
Three attacks in three weeks. Each one used the last as a stepping stone. The 20,000 other vulnerable repositories we identified are the next target list. Scan your repos before someone else does.
Free Tool
Download Runner Guard
[SCAN NOW - FREE](https://www.vigilantdefense.com/resources/runner-guard)
Enterprise Platform
ThreatCERT by Vigilant
[LEARN MORE](https://www.vigilantdefense.com/threatcert)
Read the Full 50K Scan Research
The largest CI/CD security scan ever conducted. 50,012 repos. 192,776 findings.
[VIEW RESEARCH REPORT](https://www.vigilantdefense.com/research/github-top-50k-repos-cicd-security-scan)
**Sources:** The Register, The Hacker News, Wiz Security Blog, Snyk Security Research, ARMO Security, GitHub Advisory Database, Vigilant 50K Scan Research.
The detection capabilities described above are active across Vigilant client environments today. If your organization wants to assess its current exposure to this attack chain — or understand how our managed services align to your specific environment — contact your Vigilant account team or reach us at [vigilantdefense.com](https://vigilantdefense.com).
This event reinforces what Vigilant has long asserted:
Nation-state adversaries are not probing our networks — they are preparing battlefields.
Stay alert, stay aggressive, stay Vigilant,
Chris Nyhuis
CEO, Vigilant
Vigilant, 7570 Bales Street
Suite 250, West Chester
Ohio 45069, United States
855-238-4445
Background
CEO of Vigilant, a global cybersecurity firm he has led for 16 years. 30+ years of experience across offensive security, SCADA/IoT, and critical infrastructure defense. Holds multiple patents including Forensically Validated Detection Systems and Secure Protocol Translation. Former instructor at a US intelligence school. Certified human trafficking investigator and OSINT practitioner. Vigilant dedicates 25% of profits to combating human trafficking, child exploitation, and supporting orphan care worldwide.
[LinkedIn](https://www.linkedin.com/in/chris-nyhuis-34427550/) · [X / Twitter](https://twitter.com/vigilance_one) · [Instagram](https://instagram.com/chris.nyhuis)
**Disclaimer:** Any indicators of compromise (IOCs), YARA signatures, or MITRE mappings provided in this document are for informational and defensive purposes only. They are derived from open-source intelligence and Vigilant's internal threat modeling. Due diligence should be exercised when integrating them into production environments. Effectiveness may vary depending on network posture, tooling, and adversary behavior.
Recent Research
- [Beyond Snapshots — Why CI/CD Security Needs Continuous Monitoring March 24, 2026](https://vigilantdefense.com/research/cicd-security-continuous-monitoring-beyond-snapshots)
- [What's Next, Fixing 50K Repos, One PR at a Time March 24, 2026](https://vigilantdefense.com/research/fixing-50k-repos-automated-pull-requests)
- [The Software Supply Chain Crisis — 74.5% of Findings Are Unpinned Actions March 24, 2026](https://vigilantdefense.com/research/supply-chain-crisis-unpinned-github-actions)
- [Fix It — SHA Pinning, Least Privilege, and the 5-Minute Security Upgrade March 24, 2026](https://vigilantdefense.com/research/fix-cicd-security-sha-pinning-least-privilege)
- [The Language Risk Matrix — Why Rust Repos Are the Most Vulnerable March 24, 2026](https://vigilantdefense.com/research/language-risk-matrix-rust-repos-cicd-security)
Subscribe to Vigilant Research
Subscribe
[](https://vigilantdefense.com)
The platform that sees what others miss. Forensically validated detection turns untrusted data into trusted intelligence.
[(855) 238-4445](tel:8552384445)
[sales@vigilantdefense.com](mailto:sales@vigilantdefense.com)
**Global Headquarters**
7570 Bales St. Suite 250
Cincinnati, Ohio 45069
**Remote Operations**
Lexington, Kentucky
#### Platform
[CyberDNA Platform](https://vigilantdefense.com/platform) [ThreatCERT](https://vigilantdefense.com/threatcert) [Vigilant AI](https://vigilantdefense.com/platform) [FVDR Network Sensor](https://vigilantdefense.com/platform) [Proof of Vigilance](https://vigilantdefense.com/pov)
#### Services
[Managed SOC](https://vigilantdefense.com/services/managed) [Platform + Overwatch](https://vigilantdefense.com/services/platform-overwatch) [Data Sources](https://vigilantdefense.com/platform) [Service Overview](https://vigilantdefense.com/services)
#### Company
[About Us](https://vigilantdefense.com/about) [Why Vigilant](https://vigilantdefense.com/why-vigilant) [Vigilant Hope](https://vigilantdefense.com/vigilant-hope) [Partners](https://vigilantdefense.com/partners) [Contact](https://vigilantdefense.com/contact)
#### Resources
[Research & Blog](https://vigilantdefense.com/research) [Request Whitepapers](https://vigilantdefense.com/research) [Runner Guard](https://vigilantdefense.com/runner-guard) [Request Demo](https://vigilantdefense.com/contact)
© Vigilant. All rights reserved.
[Terms & Conditions](https://vigilantdefense.com/terms) [Partner Terms](https://vigilantdefense.com/partner-terms)
♥ 25% of profits donated to protect the vulnerable
```json
{
"@context" : "https://schema.org",
"@type" : "BlogPosting",
"author" : {
"@type" : "Person",
"name" : "Chris Nyhuis",
"url" : "https://vigilantdefense.com/research/author/chris-nyhuis"
},
"dateModified" : "2026-08-11T16:33:59.241Z",
"datePublished" : "2026-03-25T21:37:42.000Z",
"headline" : "From Scanner to Weapon: Inside the Supply Chain Attack That Backdoored the #1 AI Key Management Library",
"image" : [ "https://vigilantdefense.com/hubfs/litellmteampcp.png" ],
"mainEntityOfPage" : {
"@id" : "https://vigilantdefense.com/research/from-scanner-to-weapon-inside-the-supply-chain-attack-that-backdoored-the-1-ai-key-management-library",
"@type" : "WebPage"
},
"publisher" : {
"@type" : "Organization",
"logo" : {
"@type" : "ImageObject",
"url" : "https://vigilantdefense.com/hubfs/VigilantLogo_horzlayout_whitetext.png"
},
"name" : "Vigilant"
}
}
```