Do the division on the exfiltration. 78,330 secrets across 2,186 organizations is about 36 secrets per victim [1], and over five days that is roughly 15,700 secrets a day [2] taken from around 437 fresh organizations a day [3]. That rate is a property of the runner rather than the attacker: secrets arrive in a job as environment variables that any step can read [14], so one malicious step reads the whole envelope.
The Trivy GitHub Action shows how the step gets in. StepSecurity reports the credential stealer landed in 76 of the 77 published version tags [6], which is 98.7 percent of the references an operator could have pinned [4]. Tags are mutable, and an attacker with control of the project can silently repoint them [16], so pinning by version was not a control. The same technique worked on the Checkmarx KICS action days later [7], and a WAV steganography stealer went into the telnyx PyPI package [8].
Platform choice did not help. Azure DevOps appears in more than 230 of the victim organizations [12], about one in ten of the set [5], and it is the platform usually left out of supply chain discussion.
Provenance matters for the rest of it. The platform breakdown is StepSecurity's decoding of CloudSEK's published dataset, not an independent tally [19], and StepSecurity says it discovered or was among the first to publicly report many of the 2026 compromises [11] while selling controls for this exact failure mode. Calling the LiteLLM compromise the largest supply chain attack on AI infrastructure to date is CloudSEK's characterization [9]. StepSecurity's further claim, that work once needing nation-state resources can now be run by one person with an AI coding agent, rests on artifacts its own team analyzed, including self-spreading worms aimed at AI coding agents and timelines compressed from months to days [18]. The CloudSEK victim list does not speak to that part.
What the list does establish is a detection gap with a named cause. Most of the 2,186 organizations learned their build systems were leaking when the data went public [4], and runners ship with open outbound network access [15], so 36 secrets per organization left the pipeline without tripping anything those organizations had instrumented. The credentials themselves are the reason this reads as a campaign and not a run of unrelated incidents: source control credentials and cloud keys landed in hundreds of victims [17], and TeamPCP's stated playbook is to spend them on the next trusted component [1].
