LiteLLM Supply Chain Attack Exposes Over 2,500 Organizations, 434,000 Pipelines
This digest was compiled by AI from multiple sources — links to the originals are below.
More than 2,500 organizations and 434,000 CI/CD pipelines were exposed in a March supply chain attack on the LiteLLM AI proxy library, after compromised Trivy scanner updates led to two malicious package releases on PyPI. The tainted versions, live for only 40 minutes, harvested cloud keys, SSH keys, tokens, and other secrets from every system where the library was installed. While Nvidia, AWS, Samsung and other major firms appear on the exposure list, CloudSEK cautions the figures reflect potential reach rather than confirmed breaches.
The Attack Chain
The compromise originated from the earlier supply chain attack on Aqua Security’s Trivy scanner. TeamPCP, the threat actor behind that breach, did not directly target LiteLLM; instead, LiteLLM’s CI pipeline automatically ingested the trojanized Trivy update. This triggered the build and release of malicious LiteLLM versions 1.82.7 and 1.82.8 to PyPI, where they remained available for approximately 40 minutes before being taken down. CloudSEK described the cascade as 'one unrevoked token, three tools deep,' illustrating how a single credential leak can ripple through interconnected build systems.
Exposed Secrets
The malicious code executed on every Python invocation without requiring an explicit import, enabling it to capture a wide array of sensitive information. Harvested data included cloud provider keys, SSH keys, Kubernetes tokens, database passwords, environment variables, runtime data, and AI provider keys. According to CloudSEK, attackers could use these secrets to hijack accounts, steal data, inject malicious commits, move laterally, and disrupt services. The firm recommends treating any secret accessible to LiteLLM—whether in process memory, injected into the job, stored on disk, or retrievable via instance metadata—as compromised.
Affected Organizations
CloudSEK’s reconstructed dataset indicates exposure across more than 2,500 organizations and 434,000 CI/CD pipelines. The list includes Nvidia, AWS, Samsung, Salesforce, Cisco, ServiceNow, Accenture Federal Services, Siemens, Regeneron Pharmaceuticals, London Stock Exchange Group, FedEx, Volkswagen, Orange, HP, Deutsche Bahn, NGINX, and Zscaler. However, the company stresses these figures describe possible reach and do not confirm that every listed entity was breached. The Hacker News reported a slightly lower count of over 2,100 potentially affected organizations.
What's Next
Organizations are advised to immediately rotate all credentials that were accessible to LiteLLM and to independently verify whether their environments were compromised. The full scope of actual data exfiltration remains unclear, and it may be months before the true impact is understood.
3 sources
LiteLLM Supply Chain Attack Exposes Over 2,500 Organizations, 434,000 Pipelines
