TeamPCP Compromised Trivy and LiteLLM; Sapphire Sleet Compromised Axios

I’ve been covering security incidents for years, and March 2026 was the worst single month for supply chain attacks targeting developer toolchains that I can recall. Three major compromises in twelve days, each using a different mechanism, each significant on its own. Together they point to a pattern that every developer needs to understand.

What Happened

March 19: Trivy compromised. A threat actor group called TeamPCP compromised Trivy, the open-source container security scanner used in thousands of CI/CD pipelines. This is the kind of tool developers trust to tell them whether their containers are safe to ship.

March 24: LiteLLM compromised. TeamPCP used the compromised Trivy to exfiltrate publishing credentials from LiteLLM’s CI/CD pipeline. Two malicious LiteLLM packages were published to PyPI: litellm==1.82.7 and litellm==1.82.8. The malware stole environment variables, SSH keys, cloud credentials, and Kubernetes secrets. About 119,000 installs happened in roughly three hours before the packages were yanked.

LiteLLM had around 95 million monthly downloads at the time and was running in approximately 36% of cloud environments doing AI workloads. The blast radius here was about as wide as it gets.

March 31: Axios npm package compromised. The North Korean state-sponsored group Sapphire Sleet (also tracked as UNC1069) compromised the npm account of the lead axios maintainer. Two backdoored versions were published within 39 minutes: axios@1.14.1 and axios@0.30.4. The payload was a cross-platform Remote Access Trojan delivered via a malicious dependency called plain-crypto-js, and axios was pulling over 100 million weekly downloads at the time.

The Pattern

These three attacks hit different layers of the same stack with the same goal: get into developer environments where credentials live.

Trivy is security scanning infrastructure, so compromising it both undermined the integrity of the scanning process and gave the attackers a credential exfiltration vector into thousands of CI/CD environments.

LiteLLM is AI application infrastructure, and compromising it specifically targeted the emerging AI development stack: companies running LLM proxies in production, often with privileged credentials for OpenAI, Anthropic, and cloud providers all in one place.

axios is generic HTTP infrastructure, one of the most installed packages in the entire JavaScript ecosystem, and compromising it was a mass-access play designed for broad initial compromise rather than targeted credential theft.

The common thread is trust and installation rate. These aren’t obscure packages that had to be social-engineered into developer stacks. They’re tools developers install without thinking about it because they’ve been safe for years.

The old assumption that popular packages are safer because they have more eyes on them has flipped. Popular packages are now more valuable targets, which means they get more sophisticated attacks.

Why pnpm and Poetry Matter Now

The package manager you use significantly affects how exposed you are to these attacks.

If you’re using bare npm with semver ranges in your package.json, you’re maximally exposed. A malicious patch release lands and your next install pulls it.

If you’re using pnpm with a frozen lockfile, you’re significantly safer. pnpm uses strict, non-flat node_modules so a malicious transitive dependency can’t reach packages it never declared. It uses content-addressable storage with hash verification, and it catches version drift before it installs.

The Python equivalent is Poetry or uv instead of bare pip. Both produce real lockfiles with per-package hashes and refuse to silently pull unexpected versions. The LiteLLM victims were almost entirely projects using bare pip with loose version specifiers.

The short version: switch to pnpm, switch to Poetry or uv, pin exact versions, commit your lockfiles, run audits in CI, and set up alerts on the packages you actually depend on so you can react within minutes when something gets compromised. The alerting half of that is what Dependabot for dependency security is built for, and Socket.dev for supply chain security is the tool that watches what a package actually does at install time rather than waiting for an advisory to be filed.

What This Means Going Forward

The pattern I’m seeing in March 2026 isn’t going away. Developer toolchains are high-value targets, attackers are getting more sophisticated about which tools to target, and the trust assumptions that the npm and PyPI ecosystems were built on no longer hold.

The good news is that the defenses aren’t complicated. None of them require buying new tools, and the ones worth adding are covered in our application security tools guide. Most of them are things professional security teams have been recommending for years. The challenge is that developer habits are hard to change: pinning dependencies feels like friction, lockfile updates feel like overhead, and reviewing transitive dependencies feels like overkill until the day you needed to have done it.

Three attacks in twelve days targeting tools that many of you have installed should make this feel more urgent. The friction of good dependency hygiene is real. The alternative is what happened in March.