Most of the 2,500 organisations hit in the LiteLLM attack were actually victims of a different breach entirely
A closer look at the data shows the Trivy scanner compromise, not the LiteLLM package, caused almost all the damage, and stolen credentials are already on sale.
Key points
- Security firm SOCRadar found that 95% of the roughly 2,188 organisations with detailed records in this incident were exposed before the LiteLLM poisoning even began on 24 March 2025.
- The real starting point was a malicious version of Aqua Security's Trivy scanning tool, published on 19 March 2025 and live on Docker Hub for several days.
- A hacking group calling itself TeamPCP used self-spreading malware called the Shai-Hulud worm to move the attack from one software package to the next automatically.
- Stolen credentials, including passwords, API keys (codes that let software talk to other services), and private cryptographic keys, are already being offered for sale on the Telegram messaging app.
- The six automated build platforms affected include GitHub Actions, GitLab CI, Jenkins, Bitbucket, CircleCI, and Buildkite, with Germany, Brazil, and France among the most heavily hit countries.
What actually happened here?
The headline number, over 2,500 organisations affected, was real. But almost all of them were hurt by a breach that started five days before the incident most people reported.
LiteLLM is a popular open-source software library, a ready-made block of code that developers drop into projects to help their applications talk to AI services. On 24 March 2025, two poisoned versions of LiteLLM appeared in PyPI, the main public store where Python developers download such libraries. They were online for roughly 40 minutes before being pulled. That window grabbed headlines.
What SOCRadar's analysis showed, first reported by SecurityWeek, is that the 40-minute LiteLLM window was the closing act, not the whole story.
The real damage began on 19 March, when a criminal group called TeamPCP published a corrupt version of Trivy, a security-scanning tool made by Aqua Security that many software teams use to check their own code for weaknesses. That malicious Trivy build then spread automatically, like a cold passing through an office, using the Shai-Hulud worm. A worm, in this context, is malicious software that copies itself from system to system without anyone clicking anything.
How did the worm spread so far?
Every time a developer's automated build system fetched the infected Trivy or LiteLLM package and ran it, a hidden file quietly executed in the background, collecting API keys, login tokens, and other secrets stored on that machine. The worm then used those stolen credentials to push more infected packages into other repositories, widening the circle with each step.
SOCRadar's record-level data covers 2,188 organisations. For 2,085 of them, roughly 95%, data collection by the malware had already stopped before 24 March, the day the LiteLLM packages appeared. The earliest stolen record is timestamped 18 minutes after the corrupt Trivy build went live on 19 March. Activity peaked on 22 and 23 March, when the bad Trivy images were still publicly available on Docker Hub, the main marketplace for pre-built software containers.
| Date | Event |
|---|---|
| 19 March, 18:05 UTC | Malicious Trivy build published; first credential stolen 18 min later |
| 22-23 March | Credential theft surges; bad Trivy images active on Docker Hub |
| 24 March | Two poisoned LiteLLM versions published to PyPI |
| 24 March, 20:09 UTC | Last recorded theft; PyPI quarantines the packages |
Should affected developers be worried right now?
Yes, and promptly. Even after the infected packages were removed, the hidden file they planted kept running on already-infected machines, because it had embedded itself in the Python interpreter's startup routine.
More than 1,000 organisations had login and authentication tokens stolen. Hundreds lost AWS cloud-service keys, Google API keys, private cryptographic keys, Slack notification addresses, and more. One organisation alone had roughly 3,477 individual secrets taken. The stolen data is now being offered in bulk on Telegram.
Developers whose build systems pulled Trivy images between 19 and 24 March should treat all secrets stored on those systems as exposed. Rotate every credential, revoke every token, and check build logs for unexpected outbound connections.
Train2Secure's developer-security awareness courses cover exactly this kind of supply-chain risk, including how to spot unexpected changes in automated build pipelines before they cause damage.
