A March supply-chain attack involving malicious versions of the LiteLLM Python package may have exposed credentials belonging to more than 2,500 organizations and hundreds of thousands of CI/CD pipelines, according to security researchers.
Attackers published two compromised versions of LiteLLM, a widely used AI gateway, after obtaining access to the project’s PyPI account. The malicious releases were designed to steal cloud keys, repository tokens, SSH keys, Kubernetes secrets, package credentials, and other sensitive information from affected environments.
Multiple research groups have since reported large collections of compromised data linked to the incident, although their estimates of the breach’s scale vary considerably.
How a brief attack stole terabytes of data
Ars Technica reported that the malicious LiteLLM release was available for about 40 minutes, while Google’s ADK investigation identified an affected installation window spanning more than six hours.
The attack, claimed by TeamPCP, began with an earlier compromise of Trivy, an open-source security scanner, through which TeamPCP obtained credentials that enabled it to move into other trusted projects. The attackers eventually gained access to LiteLLM’s PyPI and released malicious versions 1.82.7 and 1.82.8 on March 24.
The two versions used different execution methods, but their goal was the same: steal secrets from the environments where LiteLLM ran.
Hudson Rock found a 153GB RAR archive containing 433,909 files, including 118,829 CI runner dumps tied to 2,488 business domains. CloudSEK estimates that more than 2,500 organizations and 434,000 CI/CD pipelines may have been exposed.
Mocchis’ own report puts the collection of stolen material at 195 terabytes. Ars Technica has also published a detailed list of organizations reportedly affected.
Stolen credentials created downstream access risks
The broader risk extended beyond data stored on systems running LiteLLM. Stolen tokens and credentials could potentially give attackers access to cloud platforms, source-code repositories, Kubernetes environments, and other systems connected to the compromised accounts.
That is a central risk of software supply-chain attacks: compromising one trusted component can expose credentials that provide access to additional services and environments. Revoking and rotating those credentials is therefore critical even after the malicious package itself has been removed.
Security teams should review third-party package access
The LiteLLM compromise highlights the risks organizations face when trusted third-party packages have access to sensitive developer and CI/CD environments.
Security teams should audit which dependencies can access internal resources, restrict unnecessary permissions, isolate build systems, and favor short-lived credentials where possible. Organizations should also maintain procedures for quickly revoking or rotating secrets when a package or dependency is compromised.
Other News: Shell is investigating claims that the Clop ransomware group stole company data by exploiting a vulnerability in PTC software.