LiteLLM supply-chain attack exposed 2,500+ organizations

CloudSEK reported that more than 2,500 organizations and roughly 434,000 CI/CD pipelines were exposed earlier this year after attackers pushed malicious LiteLLM packages to the Python Package Index (PyPI). The firm traced the compromise to a prior supply-chain breach of the Trivy vulnerability scanner.

According to CloudSEK, the threat actor known as TeamPCP injected a compromised version of Trivy. LiteLLM’s continuous integration pipeline installed that compromised Trivy automatically, which gave the attacker access to the LiteLLM build environment. Attackers then published two malicious LiteLLM releases, versions 1.82.7 and 1.82.8, to PyPI.

The altered LiteLLM packages contained code that executed on every Python invocation without an explicit import. While the malicious packages were publicly available for about 40 minutes, CloudSEK reported that automated build systems, cached layers, ephemeral runners and developer machines copied the artifact quickly, widening the actual exposure window beyond the brief public availability.

CloudSEK reconstructed an exposure list that includes Nvidia, Amazon Web Services, Samsung, Salesforce, Cisco, ServiceNow, Accenture Federal Services, Siemens, Regeneron Pharmaceuticals, London Stock Exchange Group, FedEx, Volkswagen, Orange, HP, Deutsche Bahn, NGINX and Zscaler. The firm cautioned that the figures represent reconstructed exposure and do not prove that every listed organization was successfully compromised or that every credential was stolen.

The supply-chain compromise exposed package publishing credentials, cloud keys, SSH keys, tokens, environment variables, runtime data and AI provider keys, among other secrets. CloudSEK outlined possible attacker actions using those secrets, including account takeover, data theft, injection of malicious commits, persistence in environments, lateral movement, service disruption and deployment of malware.

CloudSEK advised treating any secret accessible to the LiteLLM library as compromised. Potentially exposed secrets should be validated and then rotated along with service accounts and active sessions. Logs should be reviewed to determine the scope and timeframe of exposure. The firm also recommended assuming compromise of secrets present in process memory, injected into CI jobs, stored on disk or retrievable through instance metadata services.

“Trivy, then the [LiteLLM] build system, then the LiteLLM release: one unrevoked token, three tools deep. That chain is what turns a single credential leak into ecosystem-wide exposure,” CloudSEK noted, adding that automated build systems compress time and can copy malicious artifacts across many environments quickly.

CloudSEK warned that AI infrastructure will likely be a target in future supply-chain attacks because such systems connect data, identity, compute and automated actions. The incident follows several open-source supply-chain compromises this year and highlights risks tied to automated dependency installation and build automation. Security teams using CI/CD pipelines and open-source packages were advised to review dependency chains, rotate secrets and tighten controls on build environments and third-party tool access.