Fetching from the wire…
01
02
03
04
05
06
07
08
Security2026-08-30 · source-backed
paddo.dev traced the chain on August 30: credentials stolen from Aqua Security's Trivy on February 27, 76 of 77 Trivy releases poisoned March 19, LiteLLM's build downloading the compromised unversioned dependency March 24 and publishing two booby-trapped versions. CloudSEK's August 11 analysis put the blast radius above 2,500 organizations, naming NVIDIA, Samsung, Cisco, Siemens, Vodafone and FedEx, with 3,459 secrets recovered from X Corp, 462 from Deloitte and 327 from Cisco. (paddo.dev) The artifact was live for about forty minutes. Sizing the damage took five months. Australian police have charged two men over the campaign.
Each link below shares sources, entities, or timing with this story.
Trivy criticizes LiteLLM / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (Trivy criticizes LiteLLM); both cover August, Cisco, FedEx, LiteLLM; overlapping topics (chain, litellm).
TeamPCP criticizes LiteLLM / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (TeamPCP criticizes LiteLLM); both cover August, Australian, February, March; overlapping topics (august, australian, campaign, charged, trivy).
Trivy criticizes LiteLLM / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (Trivy criticizes LiteLLM); both cover Aqua Security, LiteLLM, March, Trivy; overlapping topics (chain, litellm, march, trivy).
Claude criticizes LiteLLM / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (Claude criticizes LiteLLM); both cover Aqua Security, LiteLLM, March, Trivy; overlapping topics (chain, march).
Trivy criticizes LiteLLM / Shared entities / Earlier coverage
Linked by a graph relationship (Trivy criticizes LiteLLM); both cover Aqua Security, LiteLLM, March, Trivy; earlier Aqua Security coverage from 2026-03-24.
Trivy criticizes LiteLLM / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (Trivy criticizes LiteLLM); both cover LiteLLM, March, Trivy; overlapping topics (campaign, litellm).
Trivy criticizes LiteLLM / Shared entities / Earlier coverage
Linked by a graph relationship (Trivy criticizes LiteLLM); both cover CloudSEK, LiteLLM, Trivy; earlier CloudSEK coverage from 2026-08-13.
Cisco released DefenseClaw / Shared entities / Earlier coverage
Linked by a graph relationship (Cisco released DefenseClaw); both cover August, Cisco, Nvidia; earlier August coverage from 2026-08-05.