LiteLLM Supply Chain Attack Exposed 2,500+ Organizations

Supply chain attack on LiteLLM exposes 2,500 orgs, 434,000 pipelines; CloudSEK warns AI infrastructure may be next target.

By Content Team

Aug 13, 2026

ON THIS PAGE

A March 2026 supply chain attack on LiteLLM, an open source Python library, exposed more than 2,500 organizations and 434,000 CI/CD pipelines — with the malicious packages live on PyPI for only about 40 minutes. CloudSEK calls those figures reconstructed exposure, not proof that any given organization was breached.

It came in sideways. Attackers took over the release process for Aqua Security's Trivy scanner via a leaked automation token, and LiteLLM's CI pipeline installed Trivy without pinning it to a verified version. The tainted scanner then pushed two poisoned releases, 1.82.7 and 1.82.8, to PyPI.

The payload shipped as a .pth file, so it ran at Python startup with no import needed, anywhere the package was merely installed — putting cloud keys, SSH keys, repository tokens, Kubernetes secrets and AI provider keys in reach. Nvidia, AWS, Samsung, Cisco and Volkswagen appear on CloudSEK's exposure list.

Public reporting attributes the wider campaign to the financially motivated cluster TeamPCP, which never targeted LiteLLM directly, and the FBI issued a FLASH alert on it in July. If you shipped either version, treat every secret that process could reach as compromised and rotate it — then pin your dependencies.

Source: SecurityWeek

Have questions about protecting your software?

Our escrow experts are standing by to help.

Book a free demo

Want more insights like this?