A cascading supply chain attack uses stolen access from one compromised tool to compromise a second one. Mandiant described this for 3CX in 2023, and advisories in March 2026 link the Trivy compromise to malicious LiteLLM releases. The common thread is credentials inside build and CI environments.
Case one: 3CX, per Mandiant
Mandiant's April 2023 analysis says a tampered X_TRADER installer led to the compromise of 3CX's network and, after credential theft, its Windows and macOS build environments. 3CX's desktop app was then trojanized. Mandiant calls it the first software supply chain attack it had seen lead to another.
Case two: Trivy and LiteLLM, as reported
The GitHub advisory for Trivy (GHSA-69fq-xp46-6x23) says that on 19 March 2026 a malicious Trivy v0.69.4 was distributed, 76 of 77 trivy-action tags were force-pushed to malicious commits, and all seven setup-trivy tags were replaced. The payload harvested secrets such as SSH keys, cloud credentials and tokens.
Days later, the OSV advisory PYSEC-2026-2 reported two malicious LiteLLM releases on PyPI, 1.82.7 and 1.82.8. It says the attacker got in after an API token was exposed through a compromised Trivy dependency. The oss-security post that carried it hedges this link and gives no detail on how the token was exposed. Treat the connection as reported, not independently confirmed here.
What the two have in common
Both depend on the same quiet fact: CI and build systems hold publishing and cloud credentials, and anything that runs inside them can read those credentials.
- A tool you trust runs with your secrets in reach.
- The tool is altered at the source, not on your side.
- The stolen secret opens a door at a second organisation, which then ships to its own users.
Where to cut the chain
- Pin third party actions and tools to a full commit SHA or an image digest. GitHub's hardening guide says a tag can be moved if an attacker gains access to the repository.
- Give each job only the secrets it needs. A scanner step rarely needs a package registry publish token.
- Use short lived, scoped credentials for publishing, so a stolen one expires quickly.
- Separate the job that scans from the job that publishes.
- Rotate in one coordinated pass after an incident. The Trivy advisory says to rotate everything a possibly affected pipeline could reach.
After an incident
Ask a second question beyond "were we affected": what could our credentials have done at other organisations? If your token could publish a package, your users are the next link.
Where Safeguard fits
Safeguard's policies, gates and dependency scanning can enforce rules such as approved sources and pinned references on builds. They reduce exposure but do not remove the need to scope secrets per job.
Quick check
Is the Trivy to LiteLLM link confirmed?
It is stated in the OSV advisory, but the oss-security post hedges it and gives no mechanism. Check the primary advisories before relying on it.
Why are CI secrets the common target?
They sit where untrusted or updated code runs, and they often carry publish and cloud rights.
Sources
- Mandiant: 3CX software supply chain compromise
- GitHub advisory GHSA-69fq-xp46-6x23 (Trivy)
- oss-security: litellm compromise (25 March 2026)
- GitHub: security hardening for Actions
Last reviewed: 19 October 2026.
