LiteLLM Supply Chain Breach Exposes Enterprise CI/CD Secrets

A sophisticated supply chain attack involving malicious versions of the LiteLLM open-source AI gateway has potentially compromised sensitive credentials across more than 2,100 organizations. Threat intelligence firm CloudSEK identified that versions 1.82.7 and 1.82.8 of the package, which were active on the Python Package Index (PyPI) for approximately 40 minutes on March 24, contained automated exfiltration logic designed to harvest cloud keys, SSH credentials, and Kubernetes tokens.

The malicious code utilized a file named litellm_init.pth to execute at interpreter startup, ensuring the payload triggered regardless of whether the LiteLLM library was explicitly imported. This mechanism allowed the malware to scrape environment variables, including critical model API keys like OPENAI_API_KEY and ANTHROPIC_API_KEY, and transmit the data to an attacker-controlled domain. The incident is part of the broader TeamPCP campaign, tracked by Google as UNC6780, which previously targeted the Aqua Security Trivy scanner.

Evidence suggests the attackers leveraged stolen PyPI publishing tokens obtained during the earlier compromise of the Trivy dependency chain to push the poisoned LiteLLM releases. CloudSEK synthesized a dataset of approximately 434,000 captured files to map potential exposure, utilizing CI runner identity signals to attribute stolen data to specific organizations. High-confidence matches required the presence of both host identity data and legitimate committer domains within the captured logs.

The scope of the breach extends beyond direct users of LiteLLM, as unpinned transitive dependencies within agent frameworks or orchestration tools could have pulled the malicious versions into build environments without developer intervention. Organizations including NVIDIA, Cisco, Deloitte, Volkswagen, FedEx, Siemens, and X Corp appear in the exposed dataset, though inclusion does not definitively confirm the misuse of stolen credentials. The FBI, in advisory FLASH-20260702-01, emphasized that credentials exfiltrated during this campaign remain a persistent threat until rotated.

Technical analysis from Unit 42 and other security researchers confirms the campaign’s downstream impact, noting unauthorized access to GitHub repositories and the exfiltration of significant data volumes from cloud accounts. CERT-EU reported that a European Commission AWS account was compromised via the Trivy supply-chain vector, resulting in the loss of approximately 91.7 GB of compressed data. These incidents underscore the vulnerability of CI/CD pipelines to persistent, long-lived secret exposure.

The attackers demonstrated a high degree of operational maturity by targeting the trust model of the Python ecosystem. By force-pushing malicious commits to Trivy version tags and subsequently using those compromised environments to publish the LiteLLM malware, the actors effectively weaponized the automated update mechanisms that many enterprises rely upon for security. This multi-stage approach highlights how a single weak link in a dependency chain can be leveraged to gain broad, persistent access across diverse infrastructure environments.

The reliance on static, long-lived tokens in automated build systems remains the primary architectural weakness exploited by these actors. Security teams are advised to transition toward temporary, short-lived credentials and implement strict dependency pinning to mitigate the risk of automated supply chain injections. The ability for attackers to force-push commits and bypass standard CI/CD workflows demonstrates a critical failure in the integrity of automated software distribution channels.

Architectural governance must now account for the reality that even trusted, open-source dependencies can be compromised at the source. Implementing robust verification processes for third-party packages, such as hash-based integrity checks and isolated build environments, is essential to limit the blast radius of future incidents. Organizations must treat all external code as potentially untrusted, regardless of its previous reputation or adoption levels within the development community.

Enterprise architects must prioritize the rotation of all secrets that were accessible to build environments during the March 24 exposure window. Monitoring for indicators of compromise, such as the presence of repositories prefixed with tpcp-docs, remains a necessary step for organizations to verify their security posture. Future resilience will depend on moving away from static authentication methods and adopting more granular, ephemeral access controls for all automated infrastructure components.