Somewhere, a security scanner meant to catch vulnerabilities became the vulnerability. The tool literally named after finding software risks got compromised, then quietly poisoned the CI pipeline of one of the most widely used AI gateway libraries on the planet. If irony had a CVE number, this would be it.

The Chain Reaction Nobody Saw Coming

Attackers tracked as TeamPCP backdoored the open-source Trivy GitHub Action on March 19, 2026. LiteLLM's own build pipeline auto-installed the poisoned Trivy, which quietly stole LiteLLM's PyPI publishing tokens. Five days later, TeamPCP used those tokens to push two malicious LiteLLM package versions straight to PyPI — and every CI runner that pulled the update got infected with a credential-harvesting payload Google tracks as SANDCLOCK.

The payload escalated to root and swept up SSH keys, AWS/GCP/Azure credentials, Kubernetes tokens, .env files, and CI/CD secrets on every machine it touched. The resulting haul: a 153GB archive of roughly 434,000 files, tied to more than 2,400 corporate domains, with AI provider API keys and cloud IAM credentials from companies including Microsoft, Nvidia, PayPal, and Deloitte turning up in the dump.

The Part That Should Worry Every AI-Powered Business

LiteLLM isn't some obscure dependency — it's the connective tissue a huge number of companies use to route requests to OpenAI, Anthropic, and other model providers. Compromise that one library, and you're not stealing from one company, you're harvesting secrets from thousands at once, including the very API keys that gate access to the AI tools everyone rushed to adopt.

The uncomfortable truth here is that nobody did anything obviously wrong — teams trusted a security scanner, from a reputable open-source project, auto-updating like it's supposed to. That's exactly the trust relationship supply-chain attacks are built to exploit, and it's why "we use a well-known library" stopped being a security answer a long time ago.

The scanner got scanned, the gatekeeper got gated, and 2,500 companies found out the hard way that dependency trees have very long roots.

If your team is wiring AI tools into production without a plan for what happens when a dependency turns hostile, that's exactly what our free security checklist walks through — grab the supply-chain defense guide before your next `npm install` does the deciding for you.

Source: Help Net Security