LiteLLM Attack's True Reach Exposed

When news of the LiteLLM supply chain attack first surfaced earlier this year, the immediate focus was on the malicious PyPI packages. Now, threat intelligence firm CloudSEK has pieced together the full scope of the fallout: more than 2,500 organizations and over 430,000 CI/CD pipelines were exposed, according to a report from SecurityWeek.

From Trivy to LiteLLM

CloudSEK reports that TeamPCP, the threat actor behind multiple high-profile open source software (OSS) compromises, never targeted LiteLLM directly. The open source Python library and proxy server was compromised after its CI pipeline automatically installed the compromised Trivy version. This happened shortly after the supply chain attack on Aqua Security’s Trivy open source vulnerability scanner, and the LiteLLM compromise was a direct result of it.

One Token, Three Tools Deep

CloudSEK highlights the chain of events: “Trivy, then the [LiteLLM] build system, then the LiteLLM release: one unrevoked token, three tools deep. That chain is what turns a single credential leak into ecosystem-wide exposure.” The company notes that automated build systems compress time, allowing malicious artifacts to spread rapidly through scheduled jobs, dependency resolvers, ephemeral runners, developer laptops, and cached layers. “The forensic and credential-rotation window therefore extends beyond package removal,” the company continues.

Malicious Code in Two Versions

Two LiteLLM versions, 1.82.7 and 1.82.8, were pushed to PyPI. The modified versions contained malicious code that executed on every Python invocation, with no explicit import. The payload ran on all systems where the package was installed, giving the hackers access to all the information LiteLLM touched.

40-Minute Window, Wide Exposure

CloudSEK says the affected packages were live for only 40 minutes, but that was enough for the malicious code to propagate, ultimately exposing 434,000 CI/CD pipelines and impacting over 2,500 organizations.

• 2,500+ organizations affected
• 434,000 CI/CD pipelines exposed
• Two malicious versions pushed to PyPI
• 40 minutes of exposure time

Who's on the List

CloudSEK’s list includes some of the biggest names in technology and business: Nvidia, AWS, Samsung, Salesforce, Cisco, ServiceNow, Accenture Federal Services, Siemens, Regeneron Pharmaceuticals, London Stock Exchange Group, FedEx, Volkswagen, Orange, HP, Deutsche Bahn, NGINX, and Zscaler, among others. However, CloudSEK cautions that these figures describe reconstructed exposure, not confirmed compromise. “The 2,500+ company and 434,000 pipeline figures describe reconstructed exposure. They should not be read as proof that every listed organization was successfully compromised or that every credential was stolen,” the company says, noting that compromise should be independently verified in each case.

Sensitive Information Exposed

The attack led to broad sensitive information compromise: package publishing credentials, cloud keys, SSH keys, tokens, environment variables, runtime data, and AI provider keys, among others. Hackers could use these secrets to take over accounts, steal data, inject malicious commits, achieve persistence, move laterally, disrupt services, deploy malware, and mount various other types of attacks.

What Organizations Should Do

CloudSEK advises organizations to consider any secret accessible to the LiteLLM library as compromised, including those “present in process memory, injected into the job, stored on disk, or retrievable through an instance metadata service”. Potentially compromised secrets should be validated, then rotated alongside service accounts and sessions, and logs should be reviewed to determine the exposure scope and timeframe.

AI Infrastructure as the Next Target

CloudSEK warns that the next major supply chain attack will likely target AI infrastructure, as these systems have become “high-value junctions between data, identity, compute, and autonomous action”. The company notes, “The incident was not only a software supply chain breach that happened to involve an AI product. It demonstrated that compromising an AI control point can expose the identities and systems around it. Future attacks are likely to target the AI layer precisely because it is connected to everything else.”

The LiteLLM incident underscores how a single compromised credential can ripple through the software supply chain, turning a vulnerability scanner update into a widespread exposure event. For organizations relying on AI-driven proxies and automated build pipelines, the attack highlights the need for rigorous secret rotation and monitoring beyond package removal. The full extent of the impact may not be known until each listed organization completes its own verification.