● Covered by 4 sources · 5 reportsHigh impact3 negative2 neutral
Supply Chain Attacks Target Open Source, Impacting Over 2,500 Organizations
Key points
- Supply chain attacks on open source increased in 2025 and 2026.
- Over 2,500 organizations and 430,000 CI/CD pipelines were impacted.
- Attack originated from Aqua Security's Trivy vulnerability scanner.
- LiteLLM was compromised after installing the infected Trivy version.
- Terabytes of credentials, including cloud keys, were exposed.
Increased Supply Chain Compromises
The Google Threat Intelligence Group (GTIG) and Mandiant have observed a significant increase in open source software supply chain compromises during 2025 and the first half of 2026. These attacks target code repositories, software dependencies, and developer tools, and are expected to continue growing through 2026 and beyond.
These incidents follow a pattern of supply chain attacks that exploit weaknesses in package repositories and CI/CD systems to spread malware to open source projects, often seeking to exfiltrate credentials for broader exploitation.
Trivy Compromise Leads to Widespread Impact
A recent supply chain attack, attributed to the threat actor TeamPCP, impacted over 2,500 organizations and 430,000 CI/CD pipelines. The incident began with the compromise of Aqua Security’s Trivy open source vulnerability scanner.
The malicious code, described as a worm, propagated downstream to multiple packages and repositories. It automatically executed when an infected package was fetched and run, harvesting credentials, tokens, API keys, and other secrets. Stolen developer secrets were then used to modify accessible packages and push malicious versions to registries, expanding the attack surface.
LiteLLM Affected, Credentials Exposed
The open source Python library and proxy server LiteLLM was compromised after its CI pipeline automatically installed the infected Trivy version. Two LiteLLM versions, 1.82.7 and 1.82.8, were pushed to PyPI, providing attackers access to information LiteLLM processed.
This compromise resulted in the exposure of terabytes of credentials, including cloud keys, repository tokens, SSH keys, Kubernetes secrets, package publishing credentials, environment variables, and AI provider keys. Organizations such as Microsoft, Amazon, Cisco, Samsung, and Salesforce were among those whose access secrets were exposed during a 40-minute window in March.
Industry Response and Mitigation
GitHub has implemented new security measures for npm and GitHub Actions to disrupt common supply chain attack techniques. These updates include account protection for high-impact npm accounts and safer defaults for GitHub Actions checkout, aiming to limit the spread of malware.
Addressing supply chain attacks requires a holistic approach, prioritizing mitigations that break the most impactful links in the attack chain. Organizations are advised to implement defensive strategies that directly address this threat vector.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
Primary sources
GitHub en/get-started GitHub software-development/innersource GitHub github-early-access/actions-native-egress-firewall GitHub en/github GitHub axios/axios GitHub wiz-sec-public/SITFHow outlets covered it
SOCRadar reports that the majority of 2,500 organizations believed to be affected by a recent supply chain attack were compromised through Aqua Security's Trivy scanner, not LiteLLM. This changes the understanding of the attack's primary vector and timeline, indicating a broader initial compromise originating from Trivy.
A supply-chain attack on LiteLLM, an open-source tool for AI software development, exposed terabytes of credentials belonging to over 2,500 organizations, including Microsoft, Amazon, and Cisco. The breach occurred in March through compromised LiteLLM versions downloaded from the Python Package Index, stemming from an earlier infection of the Trivy vulnerability scanner. This incident highlights significant vulnerabilities in software supply chains and AI security practices.
A CloudSEK report reveals that the LiteLLM supply chain attack, stemming from a compromise of Aqua Security's Trivy vulnerability scanner, impacted over 2,500 organizations and 430,000 CI/CD pipelines. This incident highlights the rapid propagation of malicious code through automated build systems, exposing sensitive information like cloud keys and SSH keys across a wide range of companies.
Google Threat Intelligence Group (GTIG) and Mandiant observed a significant increase in open source software supply chain compromises during 2025 and the first half of 2026. These attacks, which target code repositories, software dependencies, and developer tools, are expected to continue growing through 2026 and beyond, necessitating updated defensive strategies for organizations.
npm and GitHub Actions have introduced new security measures to disrupt common supply chain attack techniques, focusing on initial compromise vectors. These updates include account protection for high-impact npm accounts and safer defaults for GitHub Actions checkout, aiming to limit the spread of malware.