LiteLLM supply-chain attack leaks terabytes of credentials

Security researchers from CloudSEK and Hudson Rock have uncovered a massive supply-chain breach stemming from LiteLLM, an open-source tool used to streamline AI software development. By analyzing a 195-terabyte data file, researchers discovered that a 40-minute window in March exposed sensitive credentials across approximately 434,000 continuous integration and continuous delivery pipelines. The breach impacted over 2,500 organizations, including major technology giants such as Microsoft, Amazon, Cisco, Samsung, and Salesforce.

The compromise originated from a prior supply-chain attack on Trivy, a widely used vulnerability scanner. Because Trivy developers failed to fully revoke an automation token over a 20-day window, attackers force-pushed malicious code to downstream builds. This campaign, attributed to a teenage hacking group known as TeamPCP, also infected KICS and the Telnyx Python SDK. Users who downloaded compromised versions 1.82.7 and 1.82.8 of LiteLLM from the Python Package Index repository had their system memory scraped, exfiltrating cloud keys, SSH keys, Kubernetes secrets, Slack signing secrets, and AI provider keys.

For software developers and DevOps engineers, this incident highlights the severe risks of rushing AI integrations without robust security guardrails. Security experts warn that many exposed credentials remain active because organizations have failed to properly revoke them. Practitioners who have utilized LiteLLM, Trivy, or downstream AI packages must immediately audit their environments for the compromised versions. Security firms advise performing aggressive credential revocation, which includes rotating all database passwords, cloud keys, Kubernetes service account tokens, and GitHub or GitLab personal access tokens that were accessible to the LiteLLM environment.