A supply chain attack on LiteLLM has leaked 153 GB of credentials and authentication secrets, potentially compromising over 2,500 companies and more than 434,000 CI/CD pipelines.
With over 97 million monthly downloads, LiteLLM is an open-source AI gateway that provides developers with a unified interface to interact with various AI models.
CloudSek attributed the LiteLLM supply chain attack to malicious actor TeamPCP, linked to the compromise of Aqua Security’s Trivy open-source vulnerability scanner, which automatically deployed malicious packages.
LiteLLM supply chain attack hits over 2,500 companies and 434,000 CI/CD pipelines
On March 24, 2026, TeamPCP used the compromised credentials to publish two malicious LiteLLM versions 1.82.7 and 1.82.8 to the Python Package Index (PyPI), which were live for about 40 minutes. The malicious LiteLLM versions automatically executed on every Python invocation, resulting in widespread, unattended compromise on all systems where the model was installed.
“The malicious packages were live for 40 minutes, but the window mattered to defenders long after it mattered to the attacker,” said Rohit Valia, CEO of cybersecurity company Tumeryk. “Any system that pulled 1.82.7 or 1.82.8 during those 40 minutes ran malware on every subsequent Python startup, meaning credentials harvested from those environments have been sitting in attacker hands since before most teams knew there was an incident.”
CloudSek says the breach leaked the affected organizations’ SSH keys, AWS, GCP, and Azure credentials, Kubernetes tokens, .env files, CI/CD secrets, LLM API keys, and gateway configurations. However, the firm said it found no evidence that the leaked secrets were circulating on the underground cybercrime marketplaces. Nevertheless, attackers could later utilize the compromised credentials for a subsequent supply chain attack.
CloudSek estimated that the supply chain attack potentially affected over 2,500 organizations, including Samsung, Salesforce, Cisco, HP, ServiceNow, Siemens, Airbus, John Deere, FedEx, X Corp (formerly Twitter), Zscaler, and Epic Games.
However, some leaked credentials had no identifying email addresses, custom domain, or server names, making it difficult to link them to any organization. Additionally, the threat intelligence firm warned that the dataset reflects credential exposure, not confirmed data breaches.
“The 2,500+ company and 434,000 pipeline figures describe reconstructed exposure. They should not be read as proof that every listed organization was successfully compromised or that every credential was stolen,” the company warned.
Nevertheless, threat intelligence firms Hudson Rock and CloudSek advised organizations that deployed poisoned LiteLLM versions 1.82.7 and 1.82.8 to assume they were compromised. Consequently, they should validate and rotate their secrets, service accounts, and sessions, and audit access logs for malicious activity.
“Any credential readable by the affected process, present in process memory, injected into the job, stored on disk, or retrievable through an instance metadata service should be treated as potentially exposed until validated,” CloudSek added.
Without dwelling on attribution, CloudSek linked the supply chain attack to TeamPCP. It also noted that the LiteLLM supply chain attack stemmed from an automatic installation of compromised Trivy, an open-source vulnerability scanner that TeamPCP had previously used to distribute malware.
“Incidents like the recent LiteLLM supply chain compromise show that a single unrevoked token in an open source build chain can result in an ecosystem-wide exposure,” added Valia. “Open source innovation is essential to the pace of AI development, but enterprises need more than the raw project – they need it hardened, tested, and accountable. It also needs to be put through rigorous security validation before it reaches production. Sanctioned shouldn’t just mean ‘permitted’ – it should mean proven.”
AI infrastructure is a prime target for supply chain attacks
Threat actors increasingly perceive AI infrastructure as a prime target for supply chain attacks. CloudSek says that “AI systems are becoming high-value junctions between data, identity, compute, and autonomous action.” Additionally, the threat intelligence firm warned that future supply chain attacks will likely “target the AI layer precisely because it is connected to everything else.”
Meanwhile, SOCRadar claims that 95% of the organizations affected by the LiteLLM supply chain attack were previously affected by the Trivy security vulnerability that TeamPCP used to deploy the self-propagating Shai-Hulud worm.
“Every record carries first-seen and last-seen timestamps. The earliest is March 19 at 18:05 UTC, and the latest is March 24 at 20:09 UTC, a span of just over five days,” the threat intelligence firm stated.
“That timing lines up with the upstream Trivy compromise rather than the LiteLLM install window. The 40 minutes everyone reported was the closing act, not the whole play,” SOCRadar explained.
New information also suggests the compromised secrets were already being traded on underground cybercrime networks, including rogue Telegram channels, pointing to a more widespread supply chain attack than initially anticipated.
“One of the biggest takeaways from this latest LLM attack, especially when viewed alongside the recent wave of malicious NPM packages, is that sophisticated attackers are increasingly focused on the software supply chain. They’re looking for opportunities to compromise the tools and components that everyone trusts because that gives them an enormous amount of reach,” concluded John Strand, Owner, Black Hills Information Security.
