Sources describe a chain in March 2026: attackers compromised the Trivy scanner and its GitHub Actions, and two LiteLLM releases on PyPI followed, which an advisory links to an API token exposed through an exploited Trivy dependency. The pattern is a stolen credential moving from tool to tool.
The chain, step by step
- A security tool is compromised. Wiz Research reports malicious code pushed to Trivy and its related Actions on 19 March 2026, including force-pushed tags that CI workflows pulled automatically.
- The payload steals what the runner holds. Per Wiz, the Action code collected credentials from the build environment and sent them out.
- A publish token is exposed. The GitHub advisory for LiteLLM says two malicious releases followed "an API Token exposure from an exploited Trivy dependency". A mailing list post says the compromise came "apparently via the earlier trivy compromise".
- Malicious releases appear. LiteLLM 1.82.7 and 1.82.8 were published to PyPI, and the advisory dates from 25 March 2026.
Neither source gives the exact path of the token. Treat the link as reported, not as a full reconstruction.
Why cascades work
Build systems hold the keys to the next system. A CI job that scans code often also has access to registry tokens, cloud credentials or signing keys. If the tool in that job is hostile, everything in reach is at risk. Then the attacker uses the first haul to publish into a package that others install, and the cycle repeats with a bigger audience.
Wiz also reports a worm in npm using stolen publish tokens in the same week. The report does not tie every one of these events together, and neither should a reader.
Where to cut the chain
- Separate secrets from scanning. Run scanners in jobs that hold no publish tokens or cloud credentials.
- Use short-lived credentials. A token that expires in minutes is a smaller prize than one that lasts a year.
- Pin tools by digest or SHA. Do this for actions, images and binaries.
- Publish only from a hardened path. Use trusted publishing where your registry supports it, and avoid long-lived tokens in CI.
- Watch for unexpected releases. If you publish a package, alert on any release that did not come from your pipeline.
Questions for your own estate
Which jobs hold publish tokens? Which tools run in those jobs? Who can change those tools? If you cannot answer each in a few minutes, that is the first thing to fix.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how packages and their versions are listed so that a bad release can be found fast.
Quick check
Do the sources prove how the LiteLLM token was exposed?
No. The advisory says an API token exposure from an exploited Trivy dependency, and gives no further detail.
What is the cheapest first fix?
Take publish tokens out of any CI job that runs third-party tools, and move to short-lived credentials.
Sources
- Wiz Research, Trivy Compromised by TeamPCP, March 2026.
- GitHub Advisory Database, GHSA-5mg7-485q-xm76.
- oss-security, litellm compromise listing, 25 March 2026.
Last reviewed: 19 October 2026.
