LiteLLM Supply Chain Breach Exposes Secrets from 434,000 CI/CD Pipelines

Malicious Packages Published on PyPI

CloudSEK and Hudson Rock disclosed on Tuesday and Wednesday a LiteLLM supply chain compromise involving the open-source tool for developing AI-powered applications.

The attack affected versions 1.82.7 and 1.82.8, distributed through the project’s official page on the Python Package Index (PyPI). During a 40-minute window in March, anyone who installed those packages may have exposed secrets available in the execution environment.

The malicious code read memory from infected systems, extracted its contents, and transferred the data through an attacker-controlled channel. No CVE identifier or CVSS score has been disclosed.

Credentials Stolen from Pipelines and Cloud Environments

Hudson Rock’s analysis identified the data in a 195 TB file whose origin has not been attributed. The information reportedly relates to approximately 434,000 CI/CD pipelines that ran the compromised versions.

The data could potentially provide access to more than 2,500 organizations. The stolen secrets include:

• cloud keys and Microsoft Azure credentials;
• repository tokens and SSH keys;
• Kubernetes secrets;
• package publishing credentials;
• environment variables;
• AI provider keys;
• database passwords;
• API keys for third-party services.

Identifiers such as SALESFORCE_CLIENT_SECRET and SLACK_SIGNING_SECRET were also observed.

The credentials may still be active. In addition, many do not include domains, hostnames, or other details that would immediately identify the owning organization. For example, an @siriusxm.com address was linked to the infrastructure of subsidiary AdsWizz and does not, by itself, prove a direct breach of SiriusXM.

An Attack Linked to Trivy, KICS, and Telnyx

The LiteLLM incident is connected to an earlier supply chain attack targeting Trivy, a vulnerability scanner. The same campaign also affected KICS and the Telnyx Python SDK.

The TeamPCP group, described as consisting largely of teenagers but demonstrating advanced operational capabilities, claimed responsibility for the operation. Researchers considered the claim largely credible, while independent researcher Kevin Beaumont verified the authenticity of data associated with multiple organizations.

Companies for which a high level of confidence in the exposure was reported include Nvidia, AWS, Samsung, Salesforce, Cisco, Roche, ServiceNow, Siemens, S&P Global, Airbus US Space & Defense, John Deere, Regeneron, LSEG, Thomson Reuters, FedEx, Volkswagen, Deloitte, Thales, X, Zscaler, Epic Games, Orange, HP, Philips, Vodafone, Deutsche Bahn, BT, and NGINX.

What Organizations Should Do

Organizations that used LiteLLM should immediately check for versions 1.82.7 and 1.82.8, including downstream environments, AI proxies, and tools integrated into CI/CD pipelines.

Any secret accessible to the package during the attack window should be treated as compromised. Organizations should therefore:

1. revoke and regenerate cloud keys, tokens, SSH keys, and Kubernetes secrets;
2. change database passwords and API keys;
3. replace publishing credentials and environment variables;
4. review logs, pipelines, repositories, and cloud environments;
5. look for anomalous access and potential exfiltration channels;
6. check for abuse of SaaS platforms, AI infrastructure, and build systems.

The exposure is not limited to organizations identifiable in the dump: data lacking corporate identifiers may belong to many other entities.