{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T12:59:41.857Z",
  "stack": {
    "id": "docker",
    "label": "Docker",
    "kind": "ecosystem",
    "url": "https://pwn.watch/s/docker",
    "feed": "https://pwn.watch/s/docker/feed.xml"
  },
  "counts": {
    "incidents": 2,
    "live": 1,
    "notFullyPatched": 0,
    "patched": 2
  },
  "incidents": [
    {
      "slug": "litellm-1-107-0-pypi-compromise",
      "title": "LiteLLM 1.107.0 PyPI/Docker supply-chain compromise",
      "url": "https://pwn.watch/i/litellm-1-107-0-pypi-compromise",
      "json": "https://pwn.watch/i/litellm-1-107-0-pypi-compromise.json",
      "status": "live",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "LiteLLM (PyPI + official Docker/GHCR images)",
      "stacks": [
        "python",
        "pypi",
        "docker",
        "ai"
      ],
      "cveIds": [
        "MAL-2026-2144"
      ],
      "affectedVersions": [
        "litellm==1.107.0; Docker/GHCR tags v1.107.0, latest, main-latest, main-stable during the Oct 21 window"
      ],
      "fixedVersions": [
        "1.106.2 (pin; last known safe). Malicious 1.107.0 removed from PyPI, Docker Hub and GHCR"
      ],
      "startedAt": "2026-10-21",
      "closedAt": null,
      "updatedAt": "2026-10-22T14:02:37+02:00",
      "summary": "On Oct 21 2026 attackers compromised LiteLLM’s release pipeline and published malicious litellm==1.107.0 to PyPI (live ~2 hours) plus compromised Docker Hub/GHCR tags (v1.107.0, latest, main-latest, main-stable). The wheels install cook.pth / cook.py / sitecustomize.py that steal cloud, developer and AI-tool credentials at every Python startup and open a remote-code loader. Second LiteLLM compromise of 2026."
    },
    {
      "slug": "teampcp-trivy-checkmarx-supply-chain",
      "title": "TeamPCP supply-chain campaign: Trivy → Checkmarx GitHub Actions",
      "url": "https://pwn.watch/i/teampcp-trivy-checkmarx-supply-chain",
      "json": "https://pwn.watch/i/teampcp-trivy-checkmarx-supply-chain.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Aqua Trivy, trivy-action, setup-trivy, Checkmarx AST/KICS GitHub Actions, related Docker/VS Code artifacts",
      "stacks": [
        "github-actions",
        "docker",
        "devtools"
      ],
      "cveIds": [],
      "affectedVersions": [
        "Trivy v0.69.4; trivy-action before v0.35.0; setup-trivy before v0.2.6; Checkmarx AST v2.3.28; KICS before v2.1.20 (per vendor/CSA guidance)"
      ],
      "fixedVersions": [
        "trivy-action >= v0.35.0",
        "setup-trivy >= v0.2.6",
        "Checkmarx AST/KICS patched releases per Checkmarx updates"
      ],
      "startedAt": "2026-03-01",
      "closedAt": "2026-03-31",
      "updatedAt": "2026-03-31",
      "summary": "Threat actors tracked as TeamPCP compromised Trivy releases and GitHub Actions (including trivy-action / setup-trivy), then expanded into Checkmarx AST and KICS Actions and related artifacts. Malware stole CI/CD credentials (exfil as tpcp.tar.gz). Microsoft, Sysdig, CSA Singapore and Checkmarx published guidance in March 2026."
    }
  ],
  "changes": [
    {
      "incident": "litellm-1-107-0-pypi-compromise",
      "incidentTitle": "LiteLLM 1.107.0 PyPI/Docker supply-chain compromise",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-10-22",
      "title": "LiteLLM root cause: attacker held three developer GitHub CLI tokens, likely scraped from logs of an internet-exposed internal LiteLLM deployment (Claude Code can echo a gh OAuth token into logged response bodies), disabled branch protection and ran the release workflow against lookalike repo Berri-AI/litellm.",
      "body": null,
      "sourceUrl": "https://thehackernews.com/2026/10/litellm-suspects-github-token-leak-in.html",
      "url": "https://pwn.watch/i/litellm-1-107-0-pypi-compromise"
    },
    {
      "incident": "litellm-1-107-0-pypi-compromise",
      "incidentTitle": "LiteLLM 1.107.0 PyPI/Docker supply-chain compromise",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-10-22",
      "title": "StepSecurity full teardown: payload exfiltrates to lookalike www.litellm.dev (registered Oct 13) and an hourly loader polls a GitHub dead drop (letters9813/pythonclient-test, now deleted). Infected hosts keep polling, so anyone re-registering that username could run code on them: kill the process holding /tmp/remote_code_loader.lock, delete cook.pth/cook.py/sitecustomize.py, pin 1.106.2 and rotate everything.",
      "body": null,
      "sourceUrl": "https://www.stepsecurity.io/blog/litellm-1-107-0-compromised-pypi-backdoored-wheels-credential-stealer",
      "url": "https://pwn.watch/i/litellm-1-107-0-pypi-compromise"
    },
    {
      "incident": "litellm-1-107-0-pypi-compromise",
      "incidentTitle": "LiteLLM 1.107.0 PyPI/Docker supply-chain compromise",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-10-21T11:39Z",
      "title": "Malicious 1.107.0 wheels appear on PyPI.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/litellm-1-107-0-pypi-compromise"
    },
    {
      "incident": "litellm-1-107-0-pypi-compromise",
      "incidentTitle": "LiteLLM 1.107.0 PyPI/Docker supply-chain compromise",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-10-21T11:39Z",
      "title": "Malicious litellm==1.107.0 (all seven wheels) live on PyPI 11:39-13:23 UTC; Docker tags v1.107.0/latest/main-latest/main-stable compromised 11:46-14:20 UTC.",
      "body": null,
      "sourceUrl": "https://docs.litellm.ai/blog/security-incident-oct-21-2026",
      "url": "https://pwn.watch/i/litellm-1-107-0-pypi-compromise"
    },
    {
      "incident": "litellm-1-107-0-pypi-compromise",
      "incidentTitle": "LiteLLM 1.107.0 PyPI/Docker supply-chain compromise",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-10-21T13:23Z",
      "title": "PyPI quarantines/pulls the package (~2h window).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/litellm-1-107-0-pypi-compromise"
    },
    {
      "incident": "litellm-1-107-0-pypi-compromise",
      "incidentTitle": "LiteLLM 1.107.0 PyPI/Docker supply-chain compromise",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-10-21T14:20Z",
      "title": "Docker Hub tags cleaned / retargeted; GHCR images made unavailable earlier.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/litellm-1-107-0-pypi-compromise"
    },
    {
      "incident": "litellm-1-107-0-pypi-compromise",
      "incidentTitle": "LiteLLM 1.107.0 PyPI/Docker supply-chain compromise",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-10-21T16:20Z",
      "title": "Wiz sees stolen AWS instance-role credentials validated from 168.100.8.57 and 165.227.201.8 (sts:GetCallerIdentity, then Bedrock model listing), consistent with LLMjacking.",
      "body": null,
      "sourceUrl": "https://thehackernews.com/2026/10/litellm-suspects-github-token-leak-in.html",
      "url": "https://pwn.watch/i/litellm-1-107-0-pypi-compromise"
    },
    {
      "incident": "litellm-1-107-0-pypi-compromise",
      "incidentTitle": "LiteLLM 1.107.0 PyPI/Docker supply-chain compromise",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-10-21T20:30Z",
      "title": "LiteLLM posts containment update; investigation ongoing.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/litellm-1-107-0-pypi-compromise"
    },
    {
      "incident": "litellm-1-107-0-pypi-compromise",
      "incidentTitle": "LiteLLM 1.107.0 PyPI/Docker supply-chain compromise",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-10-19",
      "title": "LiteLLM temporarily expands release permissions for two internal engineers (daily bugfix backports).",
      "body": null,
      "sourceUrl": "https://thehackernews.com/2026/10/litellm-suspects-github-token-leak-in.html",
      "url": "https://pwn.watch/i/litellm-1-107-0-pypi-compromise"
    },
    {
      "incident": "teampcp-trivy-checkmarx-supply-chain",
      "incidentTitle": "TeamPCP supply-chain campaign: Trivy → Checkmarx GitHub Actions",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-03",
      "title": "Trivy compromise disclosed; Microsoft guidance published.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/teampcp-trivy-checkmarx-supply-chain"
    },
    {
      "incident": "teampcp-trivy-checkmarx-supply-chain",
      "incidentTitle": "TeamPCP supply-chain campaign: Trivy → Checkmarx GitHub Actions",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-03",
      "title": "Campaign expands to Checkmarx GitHub Actions (Sysdig / Checkmarx updates).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/teampcp-trivy-checkmarx-supply-chain"
    }
  ]
}