Supply‑Chain Hijack of LiteLLM Exposes 2,500+ Companies via Trivy Trojan
TeamPCP injected a trojanized Trivy release into LiteLLM’s CI pipeline, causing compromised versions 1.82.7 and 1.82.8 to execute hidden code on every Python call for 40 minutes. The brief window reached over 430,000 CI/CD pipelines, affecting more than 2,500 organizations and exposing credentials, cloud keys and AI provider tokens.