LiteLLM supply-chain attack exposed 2,500 firms’ secrets

A supply-chain attack tied to the open-source AI tool LiteLLM exposed sensitive credentials at roughly 2,500 organizations, according to reports from cybersecurity firms CloudSEK and Hudson Rock.

The incident centered on malicious LiteLLM releases distributed via the Python Package Index (PyPI) in March. Researchers estimated the compromise touched about 434,000 continuous integration and delivery (CI/CD) pipelines, where automated build workflows routinely fetch third-party packages.

How the malicious PyPI releases reached CI/CD systems

Because CI/CD pipelines commonly pull dependencies during build Officials and researchers said the compromise relied on poisoned software versions executing inside development workflows at scale. Because CI/CD pipelines commonly pull dependencies during build steps, the malicious code could run inside build agents and containerized runners without separate user interaction. Once executed, the tooling was designed to scrape machine memory and send collected data off the system. Researchers said the collection and exfiltration happened within a roughly 40-minute window, a time frame that enabled rapid harvesting before many standard detections or manual checks could intervene. What data was taken and which organizations were affected According to the reporting, the stolen dataset included cloud keys, repository tokens, SSH keys, Kubernetes secrets, and AI provider credentials. Researchers warned that if such secrets remain active, they can provide extensive access to source code repositories and cloud infrastructure.

Several large organizations were identified as having high-confidence exposure, including Microsoft, Amazon, Cisco, and Samsung. The reports did not specify how long credentials at each organization may have been accessible, nor did they confirm whether any exposed secrets were later used.

Links to TeamPCP and the earlier Trivy compromise

Researchers linked the LiteLLM event to a wider campaign attributed to a threat group known as TeamPCP, which previously compromised the vulnerability scanner Trivy. The connection was described as consistent with attempts to exploit trusted developer tools and routine update processes to reach downstream corporate environments.

Supply-chain compromises of developer dependencies are often difficult to contain quickly because affected code can execute inside automated pipelines across many teams at once. In this case, the key operational uncertainty remains whether victims rotated exposed credentials automatically or whether some may still be valid.

Remediation steps and versions to audit

Security firms advised organizations to immediately review environments for LiteLLM versions 1.82.7 and 1.82.8 . Guidance focused on identifying where those versions ran, particularly across build agents and containerized runners used in CI/CD workflows.

Remediation steps emphasized aggressive credential revocation and replacement, including cloud keys, service account tokens, and personal access tokens that were reachable from impacted environments. The unresolved question highlighted in the reporting is the extent to which those exfiltrated secrets have already been invalidated versus remaining available for follow-on access attempts.