Supply-chain attack on LiteLLM exposes secrets from 2,500+ organizations including Microsoft and Amazon

A supply-chain assault targeting LiteLLM, an open-source library widely used to simplify AI-powered software development, has exposed vast troves of sensitive access credentials from thousands of major corporations. Among those affected are Microsoft, Amazon, Cisco, Samsung, and Salesforce, alongside more than 2,500 other organizations whose keys and secrets were cached in the stolen data.

Security researchers at CloudSEK and Hudson Rock uncovered the breach and disclosed it publicly this week. The incident represents one of the year's most consequential breaches of development infrastructure.

How the attack unfolded#

The intrusion occurred during a narrow 40-minute window in March when organizations downloading LiteLLM from the official Python Package Index repository unknowingly retrieved a malicious version of the software. Hudson Rock obtained a 195TB dump of exfiltrated material; CloudSEK identified compromised artifacts suggesting the attack's scale.

The malicious LiteLLM package contained code designed to probe system memory, harvest its contents, and transmit the data to attacker-controlled servers. The compromised versions of LiteLLM were part of a broader campaign that also affected other widely deployed development tools:

• Trivy, a popular vulnerability scanning tool
• KICS, a security scanning platform
• Telnyx Python SDK, used for communications integration

Scope of the breach#

Researchers documented that approximately 434,000 CI/CD (continuous integration/continuous delivery) pipelines exposed credentials when running the infected LiteLLM builds. The stolen material includes:

• Cloud authentication keys
• Repository access tokens
• SSH credentials
• Kubernetes secrets
• Package publishing credentials
• Environment variables
• AI service provider API keys

Such a trove grants attackers potential backdoor access to the internal development systems and infrastructure of victim organizations.

Attribution and assessment#

Security researchers have attributed the campaign to TeamPCP, a loosely organized hacking group predominantly composed of teenagers. The group's involvement has been largely corroborated by independent investigators.