What was the full scope and timeline of the March 2026 LiteLLM supply chain attack, including how TeamPCP compromised the build pipeline via a poisoned Trivy scanner to publish malicious LiteLLM versions 1.82.7 and 1.82.8 on PyPI, which organizations were affected among the rough
I'll research this attack systematically, starting with the core details and then expanding to affected organizations and post mortem findings Here is the full scope and timeline of the March 2026 LiteLLM supply chain attack, compiled from Attack Timeline March 19, 2026 – TeamPCP first compromised Aqua Security's Tr...
I'll research this attack systematically, starting with the core details and then expanding to affected organizations and post mortem findings Here is the full scope and timeline of the March 2026 LiteLLM supply chain attack, compiled from
Attack Timeline March 19, 2026 – TeamPCP first compromised Aqua Security's Trivy , a widely used open source vulnerability scanner, by injecting malicious code into a Trivy dependency [12][14].
March 24, 2026, 10:39 UTC – LiteLLM version 1.82.7 was published to PyPI from a build pipeline that blindly trusted the now poisoned Trivy scanner during CI/CD security scanning [1][2][6].
March 24, 2026, 10:39–11:19 UTC – Version 1.82.8 was also pushed.
What was the full scope and timeline of the March 2026 LiteLLM supply chain attack, including how TeamPCP compromised the build pipeline viaAI-generated editorial hero image for What was the full scope and timeline of the March 2026 LiteLLM supply chain attack, including how TeamPCP compromised the build pipeline via.
AI Prompt
Create a landscape editorial hero image for this Studio Global article: What was the full scope and timeline of the March 2026 LiteLLM supply chain attack, including how TeamPCP compromised the build pipeline via. Article summary: I'll research this attack systematically, starting with the core details and then expanding to affected organizations and post mortem findings Here is the full scope and timeline of the March 2026 LiteLLM supply chain at. Topic tags: general web, ai, automation, workflow, code. Style: premium digital editorial illustration, source-backed research mood, clean composition, high detail, modern web publication hero. Use reference image context only for broad subject, composition, and topical grounding; do not copy the exact image. Avoid: logos, brand marks, copyrighted characters, real person likenesses, fake screenshots, UI text, readable text, watermarks, charts
openai.com
I'll research this attack systematically, starting with the core details and then expanding to affected organizations and post-mortem findings
Here is the full scope and timeline of the March 2026 LiteLLM supply chain attack, compiled from official disclosure, threat-intelligence reports, and independent analysis.
Attack Timeline
March 19, 2026 – TeamPCP first compromised Aqua Security's Trivy, a widely used open-source vulnerability scanner, by injecting malicious code into a Trivy dependency .
Studio Global AI
Continue your research
This page includes a source-backed answer you can continue inside Studio Global.
What is the short answer to "What was the full scope and timeline of the March 2026 LiteLLM supply chain attack, including how TeamPCP compromised the build pipeline via a poisoned Trivy scanner to publish malicious LiteLLM versions 1.82.7 and 1.82.8 on PyPI, which organizations were affected among the rough"?
I'll research this attack systematically, starting with the core details and then expanding to affected organizations and post mortem findings Here is the full scope and timeline of the March 2026 LiteLLM supply chain attack, compiled from
What are the key points to validate first?
I'll research this attack systematically, starting with the core details and then expanding to affected organizations and post mortem findings Here is the full scope and timeline of the March 2026 LiteLLM supply chain attack, compiled from Attack Timeline March 19, 2026 – TeamPCP first compromised Aqua Security's Trivy , a widely used open source vulnerability scanner, by injecting malicious code into a Trivy dependency [12][14].
What should I do next in practice?
March 24, 2026, 10:39 UTC – LiteLLM version 1.82.7 was published to PyPI from a build pipeline that blindly trusted the now poisoned Trivy scanner during CI/CD security scanning [1][2][6].
What was the full scope and timeline of the March 2026 LiteLLM supply chain attack, including how TeamPCP compromised the build pipeline via a poisoned Trivy scanner to publish malicious LiteLLM versions 1.82.7 and 1.82.8 on PyPI, which organizations were affected among the rough
I'll research this attack systematically, starting with the core details and then expanding to affected organizations and post mortem findings Here is the full scope and timeline of the March 2026 LiteLLM supply chain attack, compiled from Attack Timeline March 19, 2026 – TeamPCP first compromised Aqua Security's Tr...
I'll research this attack systematically, starting with the core details and then expanding to affected organizations and post mortem findings Here is the full scope and timeline of the March 2026 LiteLLM supply chain attack, compiled from
Attack Timeline March 19, 2026 – TeamPCP first compromised Aqua Security's Trivy , a widely used open source vulnerability scanner, by injecting malicious code into a Trivy dependency [12][14].
March 24, 2026, 10:39 UTC – LiteLLM version 1.82.7 was published to PyPI from a build pipeline that blindly trusted the now poisoned Trivy scanner during CI/CD security scanning [1][2][6].
March 24, 2026, 10:39–11:19 UTC – Version 1.82.8 was also pushed.
What was the full scope and timeline of the March 2026 LiteLLM supply chain attack, including how TeamPCP compromised the build pipeline viaAI-generated editorial hero image for What was the full scope and timeline of the March 2026 LiteLLM supply chain attack, including how TeamPCP compromised the build pipeline via.
AI Prompt
Create a landscape editorial hero image for this Studio Global article: What was the full scope and timeline of the March 2026 LiteLLM supply chain attack, including how TeamPCP compromised the build pipeline via. Article summary: I'll research this attack systematically, starting with the core details and then expanding to affected organizations and post mortem findings Here is the full scope and timeline of the March 2026 LiteLLM supply chain at. Topic tags: general web, ai, automation, workflow, code. Style: premium digital editorial illustration, source-backed research mood, clean composition, high detail, modern web publication hero. Use reference image context only for broad subject, composition, and topical grounding; do not copy the exact image. Avoid: logos, brand marks, copyrighted characters, real person likenesses, fake screenshots, UI text, readable text, watermarks, charts
openai.com
I'll research this attack systematically, starting with the core details and then expanding to affected organizations and post-mortem findings
Here is the full scope and timeline of the March 2026 LiteLLM supply chain attack, compiled from official disclosure, threat-intelligence reports, and independent analysis.
Attack Timeline
March 19, 2026 – TeamPCP first compromised Aqua Security's Trivy, a widely used open-source vulnerability scanner, by injecting malicious code into a Trivy dependency .
Studio Global AI
Continue your research
This page includes a source-backed answer you can continue inside Studio Global.
What is the short answer to "What was the full scope and timeline of the March 2026 LiteLLM supply chain attack, including how TeamPCP compromised the build pipeline via a poisoned Trivy scanner to publish malicious LiteLLM versions 1.82.7 and 1.82.8 on PyPI, which organizations were affected among the rough"?
I'll research this attack systematically, starting with the core details and then expanding to affected organizations and post mortem findings Here is the full scope and timeline of the March 2026 LiteLLM supply chain attack, compiled from
What are the key points to validate first?
I'll research this attack systematically, starting with the core details and then expanding to affected organizations and post mortem findings Here is the full scope and timeline of the March 2026 LiteLLM supply chain attack, compiled from Attack Timeline March 19, 2026 – TeamPCP first compromised Aqua Security's Trivy , a widely used open source vulnerability scanner, by injecting malicious code into a Trivy dependency [12][14].
What should I do next in practice?
March 24, 2026, 10:39 UTC – LiteLLM version 1.82.7 was published to PyPI from a build pipeline that blindly trusted the now poisoned Trivy scanner during CI/CD security scanning [1][2][6].
March 24, 2026, ~10:39 UTC – LiteLLM version 1.82.7 was published to PyPI from a build pipeline that blindly trusted the now-poisoned Trivy scanner during CI/CD security scanning .
March 24, 2026, ~10:39–11:19 UTC – Version 1.82.8 was also pushed. The malicious packages contained credential-stealing code that exfiltrated cloud credentials, SSH keys, Kubernetes configs, database credentials, API keys, and other secrets to TeamPCP's remote server .
March 24, 2026, ~11:19 UTC – PyPI quarantined the LiteLLM project (~40 minutes after first publication), but the LiteLLM team advised treating any install up to 16:00 UTC that day as suspect . The packages were downloaded over 119,000 times during the roughly 2.5-hour window .
How the Attack Worked
TeamPCP exploited a cascading supply-chain compromise: they first poisoned Trivy (an open-source security scanner), then LiteLLM's CI/CD pipeline — which used the compromised Trivy dependency in its own build security scanning — was infected during the build process, giving the attackers LiteLLM's PyPI publish credentials . This allowed TeamPCP to push malicious releases directly to PyPI, bypassing LiteLLM's normal GitHub-based release process . One analysis noted the attack "originated from the Trivy dependency used in [LiteLLM's] CI/CD security scanning workflow" .
Scale of the Data Exfiltration
Hudson Rock independently obtained and analyzed the attackers' raw archive: 153 GB containing 433,909 files and 118,829 CI runner dumps, attributed to 2,488 corporate domains.
CloudSEK reconstructed approximately 434,000 captured CI/CD pipeline files and identified over 2,500 potentially exposed organizations.
The FBI issued a flash advisory (FLASH-20260702-01) on July 2, 2026, warning of affiliated follow-on targeting .
Affected Organizations
The exposed domains included major enterprises across technology, finance, industrial, and telecom sectors. Confirmed named organizations from multiple sources include Amazon (AWS), Samsung, Cisco, Microsoft, NVIDIA, Salesforce, Volkswagen, FedEx, Deloitte, ServiceNow, S&P Global, Siemens, and BT Group. Hudson Rock noted the archive contained credentials "still valid" for many of these organizations months after the incident .
Kevin Beaumont's Post-Incident Testing
After the Ars Technica report on the breach, Kevin Beaumont independently tested compromised credentials from a major US technology company that claimed it had "rotated everything." Using a responsible-disclosure policy, he tested the credentials and found that "almost every one worked" — meaning the organization had not actually rotated its compromised secrets despite claiming otherwise .
Urgent Recommendation
Treat all secrets, API keys, cloud credentials, SSH keys, Kubernetes configurations, and any other sensitive data that were accessible to LiteLLM versions 1.82.7 or 1.82.8 as fully compromised. Immediate rotation of every credential that could have been exposed during the March 24, 2026 window is essential — regardless of whether an organization believes it rotated them already . The attack is considered the largest AI infrastructure supply-chain breach of 2026, and the stolen data remains a persistent threat for follow-on intrusions, as demonstrated by Beaumont's credential testing .
en.cryptonomist.chAI Supply Chain Breach Exposes 2,500+ Companies in 2026
March 24, 2026, ~10:39 UTC – LiteLLM version 1.82.7 was published to PyPI from a build pipeline that blindly trusted the now-poisoned Trivy scanner during CI/CD security scanning .
March 24, 2026, ~10:39–11:19 UTC – Version 1.82.8 was also pushed. The malicious packages contained credential-stealing code that exfiltrated cloud credentials, SSH keys, Kubernetes configs, database credentials, API keys, and other secrets to TeamPCP's remote server .
March 24, 2026, ~11:19 UTC – PyPI quarantined the LiteLLM project (~40 minutes after first publication), but the LiteLLM team advised treating any install up to 16:00 UTC that day as suspect . The packages were downloaded over 119,000 times during the roughly 2.5-hour window .
How the Attack Worked
TeamPCP exploited a cascading supply-chain compromise: they first poisoned Trivy (an open-source security scanner), then LiteLLM's CI/CD pipeline — which used the compromised Trivy dependency in its own build security scanning — was infected during the build process, giving the attackers LiteLLM's PyPI publish credentials . This allowed TeamPCP to push malicious releases directly to PyPI, bypassing LiteLLM's normal GitHub-based release process . One analysis noted the attack "originated from the Trivy dependency used in [LiteLLM's] CI/CD security scanning workflow" .
Scale of the Data Exfiltration
Hudson Rock independently obtained and analyzed the attackers' raw archive: 153 GB containing 433,909 files and 118,829 CI runner dumps, attributed to 2,488 corporate domains.
CloudSEK reconstructed approximately 434,000 captured CI/CD pipeline files and identified over 2,500 potentially exposed organizations.
The FBI issued a flash advisory (FLASH-20260702-01) on July 2, 2026, warning of affiliated follow-on targeting .
Affected Organizations
The exposed domains included major enterprises across technology, finance, industrial, and telecom sectors. Confirmed named organizations from multiple sources include Amazon (AWS), Samsung, Cisco, Microsoft, NVIDIA, Salesforce, Volkswagen, FedEx, Deloitte, ServiceNow, S&P Global, Siemens, and BT Group. Hudson Rock noted the archive contained credentials "still valid" for many of these organizations months after the incident .
Kevin Beaumont's Post-Incident Testing
After the Ars Technica report on the breach, Kevin Beaumont independently tested compromised credentials from a major US technology company that claimed it had "rotated everything." Using a responsible-disclosure policy, he tested the credentials and found that "almost every one worked" — meaning the organization had not actually rotated its compromised secrets despite claiming otherwise .
Urgent Recommendation
Treat all secrets, API keys, cloud credentials, SSH keys, Kubernetes configurations, and any other sensitive data that were accessible to LiteLLM versions 1.82.7 or 1.82.8 as fully compromised. Immediate rotation of every credential that could have been exposed during the March 24, 2026 window is essential — regardless of whether an organization believes it rotated them already . The attack is considered the largest AI infrastructure supply-chain breach of 2026, and the stolen data remains a persistent threat for follow-on intrusions, as demonstrated by Beaumont's credential testing .
en.cryptonomist.chAI Supply Chain Breach Exposes 2,500+ Companies in 2026
infostealers.comLargest AI Supply Chain Breach of 2026: LiteLLM Hack Impacts Thousands of Global Enterprises - Claim Your Ethical Disclosure
plainsec.comLiteLLM Breach Grew Into CI Secret Spill · PlainSec
docs.litellm.aiSecurity Townhall Updates