Resecurity Report Analyzes 415,427 CI Secret Captures Linked to LiteLLM Campaign
Summary
Resecurity says a 152.5-GiB archive tied to the March 2026 LiteLLM/Trivy campaign contains 415,427 CI secret-capture files across 2,038 repositories; its sample was dominated by GitHub Actions tokens. Attribution draws partly on published reporting.
Key points
- Resecurity analyzed an acquired 152.5-GiB archive containing 415,427 secret-capture files dated March 19–24, 2026.
- Victim manifests list 898 GitHub owners and 2,038 repositories. The report cautions that a listed repository does not establish the depth of each organization’s exposure.
- In a recovered sample of 1,073 files, Resecurity counted 2,146 secret records; GitHub Actions GITHUB_TOKEN appeared in about 98% of sampled files. Other records included cloud, registry, SSH, and signing credentials.
- The report attributes the collection to TeamPCP’s “SANDCLOCK” campaign and describes a backdoored Trivy GitHub Action leading to stolen LiteLLM PyPI publishing tokens and malicious litellm 1.82.7 and 1.82.8 packages. The attack-chain narrative partly reflects published incident reporting.
- Resecurity interprets the uniform 127.0.0.1 capture-file tag as evidence of secrets collected on CI runners, rather than intercepted over the network.
- The report recommends rotating referenced credentials, auditing repository and package activity from March 19–24, and strengthening CI secret scope, dependency pinning, and runner isolation.
Article Details
- Publisher
- Resecurity
- Report Period
- 2026-03-19 to 2026-03-24
- Scope
- Analysis of the LiteLLM/Trivy campaign victim archive, its owner and repository manifests, and a partially recovered capture-file sample.
- Sample Size
- 1,073 files recovered for sample analysis (~0.26% of 415,427 captures), containing 2,146 secret records.
- Key Statistics
- The archive contained 415,427 capture files and was reported as approximately 152.5 GiB.
- Victim manifests listed 898 owners across 2,038 repositories.
- The analyzed sample comprised 1,073 files and 2,146 secret records; the report notes this was a partial recovery.
- GitHub Actions GITHUB_TOKEN was present in approximately 98% of sampled files.
- Recommendations
- Revoke and rotate referenced persistent credentials, including GitHub App private keys, PATs, cloud credentials, registry tokens, SSH keys, and signing passwords.
- Review repository pushes, package and registry publishes, and release edits from 2026-03-19 to 2026-03-24; verify downstream artifact integrity.
- Identify and block the trojanized Action, examine CI/CD build logs, and rebuild from known-good sources.
- Use short-lived, least-privilege CI credentials; prefer OIDC federation over static keys and default GITHUB_TOKEN to read-only access.
- Pin and allow-list Actions, isolate runners, and deploy secret scanning and runner-side detection for local secret-dump files.
MITRE ATT&CK
T1059 · Command and Scripting InterpreterThe report assesses that malicious code ran in CI/CD job context on compromised runners; this is based on dataset structure and public reporting.T1068 · Exploitation for Privilege EscalationThe report states that SANDCLOCK escalated to root on compromised runners; this assessment is not confirmed by victim telemetry.T1195 · Supply Chain CompromiseThe report maps downstream package and artifact poisoning to supply-chain compromise, describing it as a propagation risk enabled by stolen publishing and repository credentials.T1195.001 · Compromise Software Dependencies and Development ToolsThe report assesses that the campaign compromised a software dependency: LiteLLM's CI reportedly auto-installed a poisoned Trivy GitHub Action. The report notes the mapping is based on dataset structure and public reporting, not confirmed victim telemetry.T1195.002 · Compromise Software Supply ChainThe report assesses compromise of a software supply-chain tool through the backdoored Trivy GitHub Action. The attack-chain account is attributed to public incident reporting and is not confirmed victim telemetry.T1552.001 · Credentials In FilesThe report describes secrets being swept from runner files and process memory, including .env files and SSH keys. Its technique assessment is not confirmed victim telemetry.T1567 · Exfiltration Over Web ServiceThe report assesses that captured secrets were aggregated and exfiltrated to actor storage. The specific exfiltration method is not detailed, and the mapping is not confirmed by victim telemetry.
Threat Actors
Malware
Products
GitHub Actionscompromise (TeamPCP / “SANDCLOCK” stealer): 415,427 on-host secret-capture files harvested from GitHub Actions / CI-CD runners across 898 owners and 2,038 repositories — with the Trivy→LiteLLM attack chain,LiteLLMResecurity has acquired 152.5 GiB of data following a supply-chain security breach involving LiteLLM, exposing stolen corporate credentials and configuration data linked to thousands of domains.
Tools
Industries
HealthcareElevance Health Healthcare ACT-ElevanceHealth-Sydney-Modernization/monorepologisticsFedEx Logistics FedEx/*ManufacturingJohn Deere Manufacturing JohnDeere-Tech/*medical devicesDräger Medical devices DraegerSoftwareDevelopment/* (16 repos)Retail84.51° (Kroger) Retail / data 8451LLC/stratum-auto-insights-pocTechnologyMicrosoft Technology microsoft/fabric-terraform-quickstart