top of page
Search

Critical Alert: Cascading Supply Chain Attacks Target Axios, LiteLLM, and Trivy

  • Writer: Kedge Security Team
    Kedge Security Team
  • Apr 4
  • 3 min read

Security researchers have identified a massive, cascading supply chain campaign executed by the threat actor group TeamPCP between March 19 and March 31, 2026. This sophisticated operation compromised several high-profile packages across NPM, PyPI, and GitHub Actions, including the ubiquitous HTTP client Axios, which sees approximately 100 million weekly downloads.


The campaign is characterized by its "cascading" nature: a breach in one tool (Trivy) provided the credentials necessary to compromise another (LiteLLM), creating a domino effect across the development ecosystem.


The Anatomy of the Campaign

The TeamPCP campaign moved through the software supply chain with surgical precision, leveraging compromised CI/CD tokens and hijacked maintainer accounts.


1. The Starting Point: Trivy (GitHub Actions)

Beginning March 19, the attackers force-pushed malicious commits to nearly all historical tags of the trivy-action repository. This meant even developers who pinned their versions (e.g., @v0.18.0) were unknowingly pulling malicious code. This initial breach allowed the attackers to exfiltrate PYPI_PUBLISH tokens from CI runner environments.


2. The Lateral Move: LiteLLM & Telnyx (PyPI)

Using the tokens stolen from the Trivy breach, TeamPCP published backdoored versions of LiteLLM (v1.82.7 and v1.82.8).


  • Persistence: The malware used a .pth file mechanism that executes every time the Python interpreter starts, requiring no explicit import.

  • Impact: The payload harvested SSH keys, cloud credentials (AWS/GCP/Azure), and Kubernetes secrets. It even contained logic to deploy privileged pods to every node in a compromised K8s cluster.

  • Side Effect: An unintended "fork bomb" occurred because the payload spawned subprocesses that triggered the .pth file again in a loop.


3. The Main Event: Axios (NPM)

On March 30, the attackers hijacked the NPM account of the lead Axios maintainer, changed the recovery email to an attacker-controlled ProtonMail address, and published malicious versions directly to NPM.


  • Malicious Versions: axios@1.14.1 and axios@0.30.4.

  • The Payload: A cross-platform Remote Access Trojan (RAT) for macOS, Windows, and Linux.

  • Evasion: The malware was designed to self-delete its setup scripts and restore a "clean" package.json to hide evidence of the injection.


Technical Summary of Affected Packages

Package

Affected Versions

Malicious Impact

Axios (NPM)

1.14.1, 0.30.4

Cross-platform RAT; C2 beaconing every 60s.


LiteLLM (PyPI)

1.82.7, 1.82.8

Credential harvester; K8s lateral movement; fork bomb.


Telnyx (PyPI)

4.87.1, 4.87.2

Infostealer delivered via a hidden .wav file.


Trivy (GitHub)

All historical tags

CI/CD secret exfiltration (NPM/PyPI tokens).


Path to Remediation: Action Required Within 24 Hours

Kedge Security recommends all engineering teams treat any host running an affected version as fully compromised.


1. Identify and Purge

Immediately audit your dependency trees for the versions listed above.


  • For Axios: Use npm list axios. If 1.14.1 or 0.30.4 is found, do not attempt to "clean" the system—rebuild the host from a known-good image.

  • Downgrade Safely: Downgrade to axios@1.14.0 or axios@0.30.3 using the --ignore-scripts flag to prevent any latent malware from executing during the install.


2. Rotate All Credentials

If an affected package was installed, assume all environment variables and local files were scraped. You must rotate:


  • NPM/PyPI Tokens: Especially those with publish permissions.

  • Cloud Provider Keys: AWS, GCP, and Azure service account keys.

  • Kubernetes Secrets: Rotate all service account tokens.

  • SSH Keys: Any keys in ~/.ssh/ that lack passphrase protection.


3. Harden the Build Environment

  • Pin by SHA, not Tag: Transition GitHub Actions from version-tag pinning (e.g., @v1) to SHA-256 integrity pinning.

  • Disable Postinstall Scripts: Run npm install --ignore-scripts in CI/CD environments to block unauthorized binary downloads.

  • Enable Provenance: Use the --expect-provenance flag in NPM and configure registries to require SLSA provenance.


Indicators of Compromise (IoCs)

Monitor your network and host logs for the following:


  • Network: Connections to sfrclak[.]com (142.11.206.73) or checkmarx[.]zone.

  • macOS File: /Library/Caches/com.apple.act.mond (Axios RAT).

  • Linux File: /tmp/pglog or unauthorized sysmon.service.

  • Python: Presence of litellm_init.pth in site-packages/


Audit your systems immediately for these critical compromises and follow the recommended remediation steps to secure your environment. If you have questions about hardening your development lifecycle or verifying your dependency tree, reach out to the Kedge team for advisory support.

 
 
bottom of page