LiteLLM Supply Chain Attack Exposed Secrets Across 2,500+ Organizations

A major software supply chain attack targeting LiteLLM has exposed credentials and CI/CD data linked to more than 2,500 organizations, underscoring how deeply AI infrastructure has become embedded in enterprise development environments.

New analysis from SOCRadar indicates the incident was significantly broader than the roughly 40-minute window in March 2026 when malicious LiteLLM packages appeared on the Python Package Index, or PyPI. Researchers reconstructed activity spanning approximately five days and roughly 434,000 captured CI/CD files. The figures represent potential exposure, not a confirmed victim count.

The compromise involved poisoned versions 1.82.7 and 1.82.8 of LiteLLM, an open-source gateway widely used to connect applications with large language model providers. Attackers harvested cloud credentials, SSH keys, Kubernetes secrets, database passwords and API keys tied to AI services, including OpenAI and Anthropic.

Researchers linked the activity to TeamPCP, which Google tracks as UNC6780. The campaign reportedly began upstream with the compromise of the Trivy security scanner before reaching LiteLLM’s software distribution chain. SOCRadar said 95 percent of organizations in its record-level dataset showed exposure activity before the malicious LiteLLM packages were published on March 24.

One of the most dangerous elements appeared in LiteLLM version 1.82.8. The package included a Python .pth startup file capable of executing malicious code when the Python interpreter launched, even when developers never directly imported LiteLLM. That widened the potential blast radius to organizations receiving LiteLLM indirectly through frameworks including MLflow, CrewAI, DSPy, OpenHands and Arize Phoenix.

The malware searched compromised systems for AWS, Google Cloud and Azure credentials, Kubernetes tokens, GitHub secrets and other sensitive data. In Kubernetes environments, it could also attempt to expand access across clusters by deploying privileged containers.

SOCRadar’s dataset includes high-confidence exposure matches associated with companies such as Cisco, NVIDIA, FedEx, Deloitte and X Corp., but researchers stressed that inclusion does not prove stolen credentials were subsequently used.

The incident highlights an emerging cybersecurity problem as enterprises adopt AI gateways, agents and orchestration frameworks. These systems increasingly sit close to cloud infrastructure, production applications and highly privileged credentials, making AI software supply chains an attractive route into broader corporate environments.

For security teams, simply uninstalling an affected package is not enough. Organizations that ran the malicious versions must assume accessible secrets may have been copied, rotate credentials and investigate downstream systems for signs of persistence or misuse.