LiteLLM Supply Chain Attack: Poisoned Trivy Scanner Explained
Category: Cybersecurity News | Supply Chain Security | AI Security | Published: October 23, 2026 | Reading time: about 15 minutes On March 24, 2026, a threat actor known as TeamPCP published two malicious versions of LiteLLM to PyPI. LiteLLM is the Python library and proxy that thousands of teams use to route requests to OpenAI, Anthropic, Google, Amazon and dozens of other model providers, and it was reportedly being downloaded about 3.4 million times a day. The attackers never found a bug in LiteLLM. Instead, they compromised Trivy, a popular vulnerability scanner that ran inside LiteLLM’s build pipeline, and used it to steal the credentials needed to publish packages as the real maintainer. A security tool became the way in. The incident was ranked among the biggest security stories of the year because of what it combined: a package that sits next to the most valuable keys in an AI stack, a trusted delivery channel, and an attack that could run wit...