top of page

TeamPCP Supply Chain Compromise: Poisoned Trivy Scanner Cascades into Malicious LiteLLM AI Gateway Releases (CVE-2026-33634)

August 21st, 2026

Critical

Our Cyber Threat Intelligence Unit is tracking a software supply chain compromise attributed to the financially motivated threat group TeamPCP (tracked by Google Threat Intelligence Group as UNC6780). The group poisoned the open-source Trivy security scanner, which cascaded into the LiteLLM AI gateway and exposed credentials across cloud, CI/CD, and AI infrastructure. On March 19, 2026, TeamPCP used compromised credentials retained after an incomplete prior credential rotation to force-push malicious commits to 76 of 77 trivy-action version tags and all 7 setup-trivy tags, and to publish a malicious Trivy v0.69.4 release. Tracked as CVE-2026-33634, this vulnerability was added to CISA's Known Exploited Vulnerabilities catalog on March 26, 2026. Because LiteLLM's build pipeline installed Trivy without version pinning, the poisoned scanner reached LiteLLM's CI/CD environment and was used to steal its PyPI publishing token, which TeamPCP used to publish two malicious LiteLLM releases, versions 1.82.7 and 1.82.8, to PyPI on March 24, 2026, for approximately 40 minutes before quarantine. CloudSEK's reconstructed exposure dataset links the broader Trivy/Checkmarx KICS/LiteLLM campaign to over 2,500 organizations and roughly 434,000 CI/CD pipeline runs, though this reflects reconstructed exposure rather than a confirmed victim count. The FBI's July 2, 2026 FLASH advisory (FLASH-20260702-01) warns that harvested credentials are likely to be weaponized well after the original intrusion. Organizations using Trivy or LiteLLM in their build pipelines during the exposure windows should treat all accessible credentials as compromised.

Technical Details

  • Threat Type: Software supply chain compromise / credential-stealing payload.

  • Severity: Critical.

    • CVE ID: CVE-2026-33634

    • CVSS: 9.4

  • Affected Component: Trivy binary v0.69.4, aquasecurity/trivy-action, aquasecurity/setup-trivy, and LiteLLM PyPI package versions 1.82.7 and 1.82.8

  • Threat Actors: TeamPCP, tracked by Google Threat Intelligence Group as UNC6780 (financially motivated cluster).


Attack Chain:

  • Initial access (Trivy): On March 19, 2026 at approximately 17:43 UTC, TeamPCP used compromised credentials, retained due to an incomplete prior rotation, to force-push malicious commits to Trivy's GitHub Actions repositories and publish a malicious Trivy v0.69.4 release.

  • Build compromise (LiteLLM):LiteLLM's CI pipeline installed the poisoned Trivy release without version pinning, allowing the compromised action to steal LiteLLM's PyPI publishing token.

  • Payload delivery: Version 1.82.7 (published 10:39 UTC, March 24, 2026) contained malicious code injected into proxy_server.py; version 1.82.8 (published 10:52 UTC) added a litellm_init.pth file that executes at Python interpreter startup regardless of whether LiteLLM is imported, bypassing --ignore-scripts protections.

  • Credential harvesting: The payload, tracked by Google as SANDCLOCK, escalated to root on CI runners and collected SSH keys, cloud (AWS/GCP/Azure) credentials from the instance metadata service, Kubernetes service-account tokens, CI/CD secrets scraped from /proc/<pid>/mem (bypassing GitHub Actions log masking), and AI provider/gateway keys.

  • Encryption and exfiltration:

    • Harvested data was encrypted with an AES-256-CBC session key wrapped by a hard-coded 4096-bit RSA public key, then exfiltrated to the typosquatted domain models[.]litellm[.]cloud (registered March 23, 2026, one day before the malicious release).

    • A documented fallback mechanism allowed the malware to instead create a public GitHub repository (tpcp-docs or docs-tpcp) in the victim's own account and upload stolen data as a release asset if the primary channel was unavailable.

  • Persistence/reuse: Stolen credentials remain usable after the malicious package is removed and can be sold, reused, or weaponized in follow-on attacks

Image by ThisisEngineering

Impact

  • Theft of cloud, source-control, container registry, Kubernetes, SaaS, and AI provider credentials from any process that could read the affected build environment.

  • Downstream repository tampering, code theft, or a second-generation supply chain compromise via stolen package-publishing tokens.

  • Unintentional public exposure of secrets where the fallback mechanism uploads stolen data as release assets inside a victim's own GitHub account.

  • Increased ransomware and extortion risk, per reporting citing a possible TeamPCP partnership with a ransomware-affiliated group.

  • Long-tail credential risk persisting for weeks or months after the malicious package is removed, since exposure is not limited to the ~40-minute PyPI publication window; CloudSEK's analysis found the majority of affected organizations were already exposed via the Trivy compromise before the LiteLLM packages went live.

Detection Method

  • Alert on installation of LiteLLM package versions 1.82.7 or 1.82.8 in any build, CI/CD, or developer environment.

  • Alert on unexpected creation of public GitHub repositories named tpcp-docs or docs-tpcp within the organization.

  • Monitor CI/CD runner outbound connections for traffic to models[.]litellm[.]cloud or other newly registered/typosquatted domains following dependency installation.

  • Monitor for anomalous reads of instance metadata service (IMDS) endpoints or mounted Kubernetes service-account token paths by build or scanning processes.

  • Alert on process memory access patterns consistent with credential scraping from /proc/<pid>/mem on CI runners.

  • Review CI/CD configurations for scanners or dependencies (e.g., Trivy) referenced by mutable version tags rather than pinned commit SHAs.

  • Review workflow logs from March 19–20, 2026 for any execution of the affected Trivy actions.

  • Monitor for reuse of previously issued cloud, source-control, registry, or AI provider credentials from unfamiliar IPs, devices, or user agents following any exposure window.

Indicators of Compromise

Type

Indicator

Description

Malware

SANDCLOCK

Google – tracked credential stealing payload.

File Hash

ceNa7wMJnNHy1kRnNCcwJaFjWX3pORLfMh7xGL8TUjg

SHA-256 of malicious litellm_init.pth file in litellm 1.82.8

Domain

models[.]litellm[.]cloud

Typosquatted C2/exfiltration domain used in the LiteLLM wave

GitHub Repository

tpcp-docs, docs-tpcp

Fallback repositories used to stage exfiltrated data in victims' own accounts


mix of red, purple, orange, blue bubble shape waves horizontal for cybersecurity and netwo

Recommendations

  • Identify any use of LiteLLM 1.82.7 or 1.82.8 and isolate affected runners, hosts, container images, and caches.

  • Rotate all credentials accessible to the affected process, including cloud, source-control, registry, Kubernetes, SaaS, database, and AI provider keys, not only LiteLLM-specific keys.

  • Hunt for the indicators above, particularly unauthorized tpcp-docs/docs-tpcp repositories within your own GitHub organization.

  • Pin CI/CD dependencies and GitHub Actions to verified, immutable commit hashes rather than mutable version tags.

  • Shorten credential lifetime and scope; prefer workload identity over long-lived static keys.

  • Review cloud, source-control, package registry, and cluster audit logs for activity tied to the exposure window.

  • Deploy continuous AI attack surface monitoring to track exposed AI infrastructure, credentials, and dependencies.

  • Maintain incident response readiness for potential second-generation supply chain compromises stemming from stolen publishing credentials.

Conclusion

The Trivy/LiteLLM supply chain compromise, tracked as CVE-2026-33634 (CVSS 9.4) and attributed to TeamPCP (UNC6780), reflects reconstructed exposure across an estimated 2,500 organizations and roughly 434,000 CI/CD pipelines, despite the malicious LiteLLM packages being live on PyPI for only about 40 minutes. This illustrates how a single compromised build dependency can escalate into ecosystem-wide, long-tail credential risk. The FBI's active FLASH-20260702-01 advisory confirms that harvested credentials continue to be weaponized. Organizations should prioritize credential rotation, IOC hunting, and continuous AI infrastructure monitoring rather than waiting for confirmed malicious activity.

bottom of page