Most of the 2,500 organisations hit in the LiteLLM attack were actually victims of a different breach entirely
A closer look at the data shows the Trivy scanner compromise, not the LiteLLM package, caused almost all the damage, and stolen credentials are already on sale.
Key points
- Security firm SOCRadar found that 95% of the roughly 2,188 organisations with detailed records in this incident were exposed before the LiteLLM poisoning even began on 24 March 2025.
- The real starting point was a malicious version of Aqua Security's Trivy scanning tool, published on 19 March 2025 and active on Docker Hub for several days.
- A hacking group calling itself TeamPCP used self-spreading malware called the Shai-Hulud worm to move the attack from one software package to the next automatically.
- Stolen credentials, including passwords, API keys (codes that let software talk to other services), and private cryptographic keys, are already being offered for sale on Telegram.
- The six automated build platforms affected are GitHub Actions, GitLab CI, Jenkins, Bitbucket, CircleCI and Buildkite, with Germany, Brazil and France among the most heavily hit countries.
What actually happened here?
The headline number, over 2,500 organisations affected, was real. But almost all of them were hurt by a breach that started five days before the incident most people reported.
LiteLLM is a popular open-source library that developers drop into projects to let their applications talk to AI services. On 24 March 2025, two poisoned versions appeared in PyPI, the main public store where Python developers download such libraries. They were online for roughly 40 minutes before being pulled. That window grabbed headlines. We covered the LiteLLM poisoning on 7 August in "Criminals Poisoned a Python Package Downloaded 95 Million Times a Month", and on 12 August SOCRadar's own record-level breakdown moved the story on considerably.
What SOCRadar's analysis showed, first reported by SecurityWeek, is that the 40-minute LiteLLM window was the closing act, not the whole story.
The real damage began on 19 March, when TeamPCP published a corrupt version of Trivy, a security-scanning tool made by Aqua Security that many software teams use to check their own code for weaknesses. That malicious build spread automatically using the Shai-Hulud worm: malicious software that copies itself from system to system without anyone clicking anything.
How did the worm spread so far?
Every time a developer's automated build system fetched the infected package and ran it, a hidden file executed quietly in the background, collecting credentials and other secrets stored on that machine. The worm then used those stolen credentials to push more infected packages into other repositories, widening the circle with each step.
SOCRadar's record-level data covers 2,188 organisations. For 2,085 of them, roughly 95%, data collection had already stopped before 24 March. The earliest stolen record is timestamped 18 minutes after the corrupt Trivy build went live. Activity peaked on 22 and 23 March, when the bad Trivy images were still publicly available on Docker Hub.
| Date | Event |
|---|---|
| 19 March, 18:05 UTC | Malicious Trivy build published; first credential stolen 18 min later |
| 22-23 March | Credential theft surges; bad Trivy images active on Docker Hub |
| 24 March | Two poisoned LiteLLM versions published to PyPI |
| 24 March, 20:09 UTC | Last recorded theft; PyPI quarantines the packages |
Should affected developers be worried right now?
Yes, and promptly. Even after the infected packages were removed, the hidden file they'd planted kept running on already-infected machines, because it had embedded itself in the Python interpreter's startup routine.
More than 1,000 organisations had login and authentication tokens stolen. Hundreds lost AWS cloud-service keys, Google API keys, private cryptographic keys and Slack notification addresses. One organisation alone had roughly 3,477 individual secrets taken. The stolen data is now being offered in bulk on Telegram.
Developers whose build systems pulled Trivy images between 19 and 24 March should treat every secret stored on those systems as exposed. Rotate all credentials, revoke tokens, and check build logs for unexpected outbound connections. That last step matters more than it sounds: SOCRadar notes that committer email addresses were taken from over 1,100 organisations, giving attackers both developer identities and machine tokens together. That's a pairing that makes follow-on phishing very straightforward.
