So, if I got it right, the LiteLLM repos weren’t compromised, it was using a fake version of Trivvy that caused the issue. Is that right?

> appears to have originated from the use of Trivy in the project's CI/CD pipeline

Well, well... shifting the blame, are we? From source:

> > Dholakia said that LiteLLM's `PYPI_PUBLISH` token, stored in the project's GitHub repo as an `.env` variable, got sent to Trivy

That token of course fully automatically typed itself into one's CI. ~lol

optimism

Python interface for LLMs infected with malware via polluted CI/CD pipeline

Two versions of LiteLLM, an open source interface for accessing multiple large language models, have been removed from the Python Package Index (PyPI) following a supply chain attack that injected them with malicious credential-stealing code.

Specifically, LiteLLM v1.82.7 and v1.82.8 have been taken down because they contain credential-stealing code in a component file, 

 in an online post that the compromise appears to have originated from the use of Trivy in the project's CI/CD pipeline.

 is an open source vulnerability scanner maintained by Aqua Security that many other projects include as a security measure. The malware campaign began in late February, when the attackers took advantage of a misconfiguration in Trivy's GitHub Actions environment to steal a privileged access token that allowed the manipulation of CI/CD, 

> **Python interface for LLMs infected with malware via polluted CI/CD pipeline**
>
> Two versions of LiteLLM, an open source interface for accessing multiple large language models, have been removed from the Python Package Index (PyPI) following a supply chain attack that injected them with malicious credential-stealing code.
>
> Specifically, LiteLLM v1.82.7 and v1.82.8 have been taken down because they contain credential-stealing code in a component file, `litellm_init.pth`.
>
> Krrish Dholakia, CEO of [Berri AI](https://github.com/berriai), which maintains LiteLLM, [said](https://news.ycombinator.com/item?id=47502858) in an online post that the compromise appears to have originated from the use of Trivy in the project's CI/CD pipeline.
>
> [Trivy](https://trivy.dev/) is an open source vulnerability scanner maintained by Aqua Security that many other projects include as a security measure. The malware campaign began in late February, when the attackers took advantage of a misconfiguration in Trivy's GitHub Actions environment to steal a privileged access token that allowed the manipulation of CI/CD, [according to Aqua Security](https://www.aquasec.com/blog/trivy-supply-chain-attack-what-you-need-to-know/).
>
>
> ![](https://m.stacker.news/135808)
>
>
>
> [**...read more at theregister.com**](https://www.theregister.com/2026/03/24/trivy_compromise_litellm/)