LiteLLM Supply Chain Attack Exposes Secrets of 2,500 Organizations

A targeted supply chain attack on the LiteLLM open-source Python library in March 2026 exposed the sensitive credentials of nearly 2,500 organizations. The breach, attributed to threat actors known as TeamPCP, demonstrates the high risk associated with the rapid deployment of AI infrastructure.

According to security research from Hudson Rock and CloudSEK, attackers injected malicious code into versions 1.82.7 and 1.82.8 of the library. These versions were available on the PyPI repository for approximately 40 minutes on March 24, 2026. The malware automatically harvested cloud keys and API tokens from the environments of any user who installed the affected versions. This operation resulted in a massive 153GB RAR archive containing 433,909 files. Hudson Rock attributed 118,829 CI runner dumps to 2,488 corporate domains, while CloudSEK estimated the attack potentially impacted approximately 434,000 CI/CD pipelines.

The Attack Vector

LiteLLM serves as an AI gateway and Python SDK, allowing developers to route requests across various large language model providers. Because the tool sits at a privileged junction between identity, compute, and data, it is a high-value target. The breach originated from a prior compromise of the Trivy vulnerability scanner, which TeamPCP used to steal the PyPI publishing tokens required to upload the malicious versions of LiteLLM.

Industry Implications

Among the potentially exposed companies are global giants including AWS, Samsung, Salesforce, Cisco, Siemens, Deloitte, and Orange. The scale of the leak highlights a systemic vulnerability in how organizations manage DevOps and supply chain security during the AI rush. The incident suggests that the drive to integrate AI has outpaced the implementation of basic security hygiene in many corporate environments.

The Path Forward

This incident underscores that AI security extends beyond the models to the tooling surrounding them. The persistence of the stolen data suggests a critical failure in credential rotation and environment auditing across major corporations. Industry observers are now monitoring how these organizations respond to the dump and whether the exposed secrets have been fully rotated to prevent further unauthorized access. The breach serves as a stark reminder that the speed of AI adoption must be matched by a rigorous commitment to supply chain integrity and the principle of least privilege for publishing tokens.