SOCRadar Data Shows 95% of Credential Harvests Preceded LiteLLM Poisoning, Tracing Breach to Trivy

TeamPCP inserted the Shai-Hulud worm into Aqua Security's Trivy container images published March 19. The worm executed on fetch, exfiltrated tokens and keys from GitHub Actions, GitLab CI, Jenkins, Bitbucket, CircleCI, and Buildkite runners, then used stolen credentials to republish malicious versions of downstream libraries including LiteLLM. Docker Hub images remained live through March 23, driving the March 22-23 activity surge.

SOCRadar records show earliest collection 18 minutes after the Trivy build, with 95 percent of activity ending before the 40-minute LiteLLM window. The .pth payload persisted on already-infected hosts after PyPI quarantine. Over 1,000 organizations lost JWT tokens; hundreds lost AWS keys, GitHub tokens, and OpenAI keys. Germany, Brazil, and France recorded the highest counts.

Prior coverage treated LiteLLM as the origin rather than a downstream artifact. The worm's self-propagation through developer secrets created a five-day ripple that official timelines collapsed into a single 40-minute event. Contract and procurement records for Trivy show widespread CI/CD integration without corresponding secret-scanning mandates.

Stolen committer emails paired with tokens enable targeted follow-on campaigns. Organizations must now audit all Trivy image layers pulled between March 19-24 and rotate every identified secret before additional packages are republished.