Fetching from the wire…
01
02
03
04
05
06
07
08
Top 5 · 2026-08-13 · source-backed
The token was rotated. It was never revoked. That gap was about twenty days wide, and it was enough.
CloudSEK disclosed that Team PCP compromised LiteLLM PyPI versions 1.82.7 and 1.82.8 by taking over the Trivy security scanner inside LiteLLM's build process. The mechanism: a leaked automation token that had been rotated but not fully revoked, leaving a window to force-push malicious code over Trivy's published version tags. Roughly 2,500 organizations and 434,000 CI/CD pipelines are potentially exposed. Harvested material includes AWS, GCP, and Azure credentials, SSH keys, Kubernetes tokens, and LLM API keys.
The detail that makes this genuinely nasty: where exfiltration to the attackers' typosquatted domain failed, the malware created a public repo inside the victim's own GitHub account and uploaded the stolen data as a release asset. Your credentials leaked from a repo you own, under your name, through an API call your automation had every right to make. Nothing in that flow looks anomalous to a naive detector.
The FBI's July FLASH advisory makes the obvious point that most incident response skips: those credentials get weaponized long after the breach. Rotating what you think was exposed is not the same as rotating everything the compromised runner could see.
This converges with something Known Agents flagged on HN (285 points): an active campaign spoofing ClaudeBot and GPTBot user-agents to mass-scan for /.config/anthropic/credentials/default.json, /.claude/settings.json, /.aws/credentials, and .env variants. Measured spoof rates are low (ClaudeBot 0.1%, Googlebot 0.5%), but ClaudeBot is 3.2% of all observed traffic and 27% of AI scraping, which is exactly why it's the identity worth stealing. Your agent config paths are in an attacker's wordlist now.
Two actions. First: pin LiteLLM, audit whether 1.82.7 or 1.82.8 ever entered a build, and if so rotate everything that runner could reach, not just what you think it touched. Check your GitHub account for public repos you didn't create. Second: make sure no agent config directory is reachable from a web-served path. Both of these take under an hour and the downside of skipping them is unbounded.
Each link below shares sources, entities, or timing with this story.
TeamPCP criticizes LiteLLM / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (TeamPCP criticizes LiteLLM); both cover AWS, Azure, GCP, Kubernetes; overlapping topics (attacker, credential, litellm).
Linked by a graph relationship (TeamPCP criticizes LiteLLM); both cover AWS, Azure, GCP, Kubernetes; overlapping topics (config, credential, litellm).
TeamPCP criticizes LiteLLM / Shared entities / Earlier coverage
Linked by a graph relationship (TeamPCP criticizes LiteLLM); both cover AWS, Azure, GCP, GitHub; earlier AWS coverage from 2026-03-27.
OpenAI uses Azure / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (OpenAI uses Azure); both cover AWS, GCP, GitHub, Kubernetes; overlapping topics (attacker, compromised).
TeamPCP criticizes LiteLLM / Shared entities / Same source domain / Shared topic / Earlier coverage
Linked by a graph relationship (TeamPCP criticizes LiteLLM); both cover Kubernetes, SSH, Trivy; reported by the same outlet (arstechnica.com).
Microsoft released Azure / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (Microsoft released Azure); both cover AWS, GitHub; overlapping topics (agent, config, credential, json, repo).
TeamPCP criticizes LiteLLM / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (TeamPCP criticizes LiteLLM); both cover Check, Kubernetes, LiteLLM; overlapping topics (agent, credential, litellm).
Claude criticizes LiteLLM / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (Claude criticizes LiteLLM); both cover AWS, Check, LiteLLM; overlapping topics (agent, credential, token).