LiteLLM Supply-Chain Attack Leaked Credentials from 2,500+ Organizations in 40-Minute Window

Massive Credential Leak Hits AI Development Tool

Terabytes of sensitive credentials have been exposed following a supply-chain attack on LiteLLM, an open-source tool used to streamline AI-driven software development. Security firms CloudSEK and Hudson Rock revealed that cloud keys, repository tokens, SSH keys, Kubernetes secrets, and AI provider keys from over 2,500 organizations were compromised1

1

. Major entities affected include Microsoft, Amazon, Nvidia, Cisco, Samsung, and Salesforce, highlighting the massive scale of this breach.

40-Minute Window Created Widespread Exposure

The credential leak occurred during a brief 40-minute window in March when victims downloaded compromised versions of LiteLLM from the Python Package Index repository. Hudson Rock discovered the breach after analyzing a 195TB file containing data from approximately 434,000 CI/CD pipelines2

2

. The malicious LiteLLM releases, specifically versions 1.82.7 and 1.82.8, were live on PyPI from 10:39 UTC on March 24 before being quarantined. Despite the short exposure period, the damage proved extensive as the credential-stealing code accessed system memory, scraped contents, and exfiltrated data through attacker-controlled channels.

TeamPCP Links Attack to Earlier Trivy Hack

The LiteLLM compromise stemmed from a previous supply-chain attack on Trivy, a widely used vulnerability scanner. TeamPCP, described as a ramshackle but capable gang largely composed of teenagers, claimed responsibility for the broader campaign1

1

. The attack chain also infected KICS and the Telnyx Python SDK. Independent security researcher Kevin Beaumont confirmed the legitimacy of the leaked data, stating it contains significant volumes of sensitive content from affected organizations. The ecosystem compromise is tracked as CVE-2026-33634 and was added to CISA's Known Exploited Vulnerabilities catalog on March 262

2

.

How the Attack Worked

The compromised versions of LiteLLM included a file named litellm_init.pth that Python processes at interpreter startup, meaning it executed whenever a Python process started in that environment, regardless of whether anything directly imported LiteLLM2

2

. This design collected environment variables, SSH keys, cloud credentials, Kubernetes tokens, and database passwords before encrypting and transmitting stolen data to models.litellm[.]cloud, an attacker-controlled domain. The payload specifically targeted model API keys including OPENAI_API_KEY and ANTHROPIC_API_KEY, exposing credentials critical to AI ecosystem operations.

High-Confidence Victims Span Critical Industries

CloudSEK identified high-confidence matches based on host identity and legitimate committer domains appearing in captured CI runner environments. Beyond the tech giants, the list includes Volkswagen, FedEx, Siemens, Deloitte, Thomson Reuters, London Stock Exchange Group, John Deere, Regeneron Pharmaceuticals, and X Corp1

1

. Many CI/CD pipelines were configured generically, meaning dumped variables contain active database passwords, third-party API keys, and cloud credentials without identifiable company information, leaving countless organizations unaware of their exposure1

1

.

Urgent Action Required Despite No Direct Usage

Security experts emphasize that organizations don't need to have knowingly used LiteLLM to be at risk. An unpinned transitive dependency, including one pulled in by an agent framework or orchestration tool, could deliver the malicious package without anyone choosing it2

2

. Both CloudSEK and Hudson Rock urge all affected organizations to perform aggressive credential revocation, assume any secret accessible to the LiteLLM environment is compromised, and invalidate all cloud keys, Kubernetes service account tokens, and GitLab/GitHub personal access tokens. The FBI warned in a July 2 advisory that TeamPCP actors are likely to weaponize exfiltrated credentials long after the initial compromise, making immediate rotation critical2

2

.

DevOps Security Gaps Enable Teen Hackers

The breach underscores serious DevOps security weaknesses in organizations racing to deploy AI capabilities. "It's a massive supply chain breach due to poor AI security -- not because AI is the threat, but teens can run circles around orgs obsessed with rushing out AI and poor DevOps security," Beaumont noted1

1

. The incident reveals how incomplete credential rotation contributed to the attack chain, as Trivy developers rotated but failed to fully revoke an automation token. Organizations should audit their environments for the compromised LiteLLM versions and move away from long-lived tokens toward temporary credentials to reduce future exposure windows.