Trivy, Not LiteLLM Behind the 2,500 Org Compromise

The root compromise stemmed from a vulnerability in Aqua Security's Trivy scanner — a widely trusted security tool — which was exploited by threat actor TeamPCP to propagate malware and harvest credentials and secrets at scale. This incident highlights a deeply ironic and dangerous pattern: security tooling itself can become a high-value supply chain attack vector, precisely because it is trusted, widely deployed, and often granted elevated permissions. The misattribution to LiteLLM also underscores the importance of thorough forensic analysis to correctly identify root causes and timelines. Organizations that rely on open-source or third-party security tools without independently validating their integrity are exposed to significant risk, as a single compromised scanner can cascade across an entire infrastructure.