In March 2026, a sophisticated supply chain attack compromised the widely used open-source proxy LiteLLM, but only now is the full scale of the downstream damage coming into focus. New forensic analysis of data exfiltrated during the incident has linked nearly 2,500 corporate domains to exposed CI/CD environments, revealing a breach that swept through the technology, industrial, financial, and telecommunications sectors with alarming reach. This is not merely a story of a single malicious package; it is a stark illustration of how deeply interconnected modern software supply chains have become and how a single point of compromise can cascade through thousands of organizations.
Cybersecurity firm Hudson Rock obtained a 153GB RAR archive containing 433,909 files associated with the TeamPCP campaign, the threat actor behind the attack. After sifting through the data, the company attributed 118,829 CI runner dumps to 2,488 corporate domains. These records contained environment variables, cloud credentials, API tokens, configuration files, and other secrets harvested from the affected systems. The archive represents a treasure trove of compromised credentials, and its analysis provides the most concrete picture yet of the incident’s sprawling impact.
The Mechanism of a Modern Supply Chain Attack
Understanding the LiteLLM breach requires tracing the attack chain from its earliest point of compromise. The incident did not begin with LiteLLM itself. Instead, the attackers from TeamPCP first compromised the software supply chain surrounding the Trivy vulnerability scanner. Trivy is a popular open-source tool used by developers to scan for security vulnerabilities in container images and code repositories. By compromising Trivy’s build environment, the attackers gained a foothold that they would later use to infiltrate LiteLLM’s infrastructure.
According to earlier investigations from Endor Labs, Snyk, Trend Micro, and Cycode, this initial compromise allowed TeamPCP to obtain the publishing credentials for LiteLLM on the Python Package Index (PyPI). With those credentials in hand, the attackers pushed two malicious versions of LiteLLM — versions 1.82.7 and 1.82.8 — directly to PyPI. Given that LiteLLM was being downloaded approximately 95 million times per month at the time, the potential exposure was staggering.
What is LiteLLM and Why Was It Targeted?
LiteLLM is a widely used open-source proxy and Python library that provides a common interface for applications connecting to numerous large language model (LLM) providers. It serves as a critical piece of infrastructure in the AI development ecosystem, allowing developers to integrate with models from OpenAI, Anthropic, Cohere, and dozens of others through a single API. Its position within AI and development infrastructure makes affected environments particularly valuable to attackers. Any system running LiteLLM can contain cloud credentials, repository tokens, Kubernetes secrets, database passwords, and keys for AI services — a rich payload for any threat actor.
The Anatomy of the Malicious LiteLLM Releases
The malicious versions 1.82.7 and 1.82.8 were not simple trojans. They deployed a multi-stage credential stealer designed for maximum data extraction and persistence. Version 1.82.8 was particularly insidious because it contained a .pth startup file. A .pth file is a Python path configuration file that can execute arbitrary code when Python initializes. This meant that on any machine where LiteLLM 1.82.8 was installed, the malware would run automatically, without requiring developers to explicitly import the LiteLLM library. The stealth of this mechanism is a key reason why the attack went undetected for a period of time.
The malware itself was engineered for thorough reconnaissance. It harvested environment variables and local files from affected systems, including the highly sensitive .aws/credentialscodecodecodecodecodecode and .kube/configcodecodecodecodecodecode files. It also attempted lateral movement within Kubernetes clusters, a tactic that could allow an attacker to move from a compromised CI runner to other parts of an organization’s containerized infrastructure. To ensure persistence, the malware installed a systemd service, meaning it would restart even if the system or container was rebooted. The service was named “System Telemetry Service,” a seemingly innocuous label designed to avoid suspicion.
The Data: What Was Actually Stolen?
Hudson Rock’s analysis of the 433,909 files in the archive reveals the breadth of the data exfiltrated. The recovered information includes a wide array of credentials and secrets that could give an attacker significant control over affected environments.
- AWS secrets: Access keys and secret keys that could be used to access Amazon Web Services resources.
- GitLab identities: Personal access tokens, CI/CD job tokens, and other credentials for source code management.
- Salesforce and Slack credentials: Login information for critical business and communication platforms.
- Azure secrets: Service principal credentials and other authentication material for Microsoft Azure.
- AI provider API keys: Keys for services like OpenAI, Anthropic, and other LLM providers, which can be expensive to run and difficult to rotate.
The archive also contained configuration files, database connection strings, and environment-specific variables. For organizations whose CI/CD environments were exposed, the risk extends beyond the immediate compromise. Credentials stored in those environments are often long-lived and may grant access to sensitive production systems.
Attribution Challenges: Whose Data Was Exposed?
One of the difficulties in assessing the damage is attribution. Hudson Rock notes that CI data may identify a developer’s parent company while the affected infrastructure actually belongs to a subsidiary or different business unit. Some dumps reportedly contain credentials but no reliable organizational identifiers at all, making it impossible to determine which company they belong to. This ambiguity means the number of affected entities could be even higher than the current estimates.
Major Firms Identified in the Exposed Data
Among the domains Hudson Rock says it identified are those of some of the world’s most prominent technology and industrial companies. The list includes AWS, Samsung, Cisco, Salesforce, ServiceNow, S&P Global, Siemens, Deloitte, Epic Games, Orange, BT, and John Deere. These should be treated as researcher-attributed exposures rather than independently confirmed breaches unless the affected companies disclose otherwise. Nevertheless, the presence of such high-value targets underscores the seriousness of the incident.
CloudSEK, another cybersecurity firm, separately analyzed exposure data from the same broader campaign. The company reported more than 2,500 potentially affected companies and roughly 434,000 CI/CD pipeline records. Its high-confidence matches include NVIDIA, Cisco, Volkswagen, X (formerly Twitter), FedEx, Zscaler, Roku, and Vodafone. CloudSEK explicitly notes that a high-confidence match indicates evidence connecting an organization or pipeline to the exposure path, not proof of successful exfiltration or later attacker activity. This is an important distinction: exposure does not automatically mean that an attacker successfully exploited the credentials or moved laterally into production systems.
How Organizations Can Check If They Were Impacted
Both Hudson Rock and CloudSEK have launched domain-checking portals that allow organizations to determine whether their infrastructure appears in the datasets. Hudson Rock’s portal is available at hudsonrock.com/litellm, and CloudSEK’s at exposure.cloudsek.com/ai-supply-chain-incident. These tools allow security teams to search by domain name and receive an indication of whether any CI runners, credentials, or configuration files from their organization were included in the captured data.
Given the scale of the breach, any organization that uses Python, integrates with LLM providers, or runs CI/CD pipelines should consider checking their exposure. Even organizations that did not directly install LiteLLM could be at risk if their developers or contractors used the compromised package in their workflows.
What Is the Actual Risk to Affected Organizations?
The presence of credentials in the exposed archive presents a clear and present danger. However, the level of risk depends on several factors, including how quickly credentials were rotated after the initial disclosure, whether the credentials were scoped to specific resources or were overly permissive, and whether network segmentation limited lateral movement. Organizations that rotated their credentials shortly after the March disclosure may have limited the window of opportunity for attackers. Those that did not are now at significant risk.
The exposed AWS keys alone could give an attacker access to S3 buckets, EC2 instances, Lambda functions, and other cloud resources. Similarly, exposed GitLab tokens could allow an attacker to read, modify, or even delete source code repositories. For AI companies, exposed API keys for LLM providers could result in financial loss if the keys are used to make unauthorized API calls. Some of these keys may also be tied to billing accounts or usage quotas, amplifying the potential damage.
The Persistence Mechanism: A Unique Threat
The systemd service installed by the malware, named “System Telemetry Service,” is a particularly concerning element of this attack. Because it is registered as a system service, it survives reboots and can operate with elevated privileges. Even if an organization removed the malicious LiteLLM package after the initial disclosure, the persistence mechanism may still be active on compromised systems. Security teams should specifically search for this service name and investigate any host where it is present.
Lessons for the Broader AI and Development Ecosystem
The LiteLLM attack is not an isolated incident. It is part of a growing trend of supply chain attacks targeting the AI and machine learning ecosystem. As organizations accelerate their adoption of AI, they are also adopting a vast and complex set of dependencies, from open-source libraries and models to cloud services and container registries. Each of these dependencies represents a potential entry point for attackers.
This incident also highlights the risks associated with open-source software. While open-source tools are essential for modern software development, they rely on a trust model that can be easily exploited. A single compromised maintainer account or a breached CI/CD pipeline can be used to distribute malicious code to millions of users. The LiteLLM case is a textbook example of how attackers are now targeting these trust relationships.
The Role of CI/CD Security
The exposed CI/CD environments are another critical lesson from this breach. Many organizations treat their CI/CD pipelines as trusted infrastructure, storing credentials, secrets, and tokens in environment variables without considering the risk of exposure. Attackers who can compromise a CI runner gain access to everything that runner can access. This incident should prompt organizations to reevaluate their CI/CD security posture, including secret rotation policies, network segmentation for build environments, and monitoring for anomalous runner activity.
Why the Scope of This Breach Is So Difficult to Pin Down
The full scope of the LiteLLM breach is unlikely to ever be known with complete certainty. There are several reasons for this. First, not all organizations that installed the malicious versions will have had their CI/CD data captured in the archive. Second, the attribution challenges mean that some organizations may be unaware that their data was exposed. Third, the separation of corporate domains from subsidiary infrastructure makes it difficult to connect specific credentials to specific organizations. Finally, the dynamic nature of CI/CD environments means that credentials are constantly being created, used, and rotated, making it hard to determine whether a captured credential was still active at the time of the breach.
Despite these difficulties, the available data provides a clear signal: the supply chain attack on LiteLLM was one of the most extensive of its kind, reaching into the development infrastructure of thousands of organizations worldwide. It represents a significant escalation in the tactics used by threat actors targeting the software supply chain.
Recommended Actions for Organizations
Organizations that installed LiteLLM 1.82.7 or 1.82.8 should treat credentials accessible to those environments as potentially exposed. The following actions are recommended for defenders:
- Rotate all credentials: Cloud provider keys, source-control tokens, Kubernetes secrets, registry credentials, SaaS API keys, database passwords, and AI provider API keys should all be rotated. This is a comprehensive task, but it is necessary to close the window of exposure.
- Rebuild affected runners from clean sources: Any CI/CD runner or build environment that ran the malicious LiteLLM versions should be rebuilt from scratch. Simply removing the package may not be sufficient if the persistence mechanism remains.
- Inspect for unauthorized files: Security teams should look for unauthorized .pth files in Python site-packages directories and the “System Telemetry Service” systemd unit. The presence of either is a strong indicator of compromise.
- Review logs for suspicious activity: Cloud, Kubernetes, source-control, and network logs should be reviewed for any suspicious activity dating from March 24, 2026, the date of the initial compromise. Look for unusual API calls, unauthorized access attempts, and lateral movement within the environment.
- Monitor for credential misuse: Even if credentials have been rotated, organizations should monitor for any attempts to use the old credentials. Attackers may have exfiltrated credentials and stored them for later use.
Looking Forward: Supply Chain Security in the AI Era
The LiteLLM attack is a watershed moment for supply chain security in the AI ecosystem. It demonstrates that attackers are not just targeting end-user applications but also the foundational infrastructure that supports AI development and deployment. The attack also showed how a single point of compromise — in this case, a vulnerability scanner — can be leveraged to gain access to a high-value target like LiteLLM, which in turn is used to distribute malware to thousands of downstream organizations.
For security teams, the lesson is clear: every dependency in the development lifecycle must be treated as a potential attack surface. This includes open-source libraries, build tools, CI/CD platforms, and container registries. The era of trusting the open-source supply chain implicitly is over. Organizations must adopt a zero-trust mindset for their software dependencies, just as they have for their networks and endpoints.
The companies whose domains appear in the Hudson Rock and CloudSEK data face an immediate task of securing their environments. But the broader industry faces a longer-term challenge: building a more resilient software supply chain that can withstand attacks like this one. This will require better verification of open-source package integrity, more robust CI/CD security, and a cultural shift that prioritizes security throughout the development lifecycle. The LiteLLM breach has provided a painful but necessary wake-up call for the entire technology industry. The response to that call will determine whether similar attacks become a recurring crisis or a catalyst for lasting change.
