Loading story…
CloudSEK reported a major AI supply-chain breach involving LiteLLM that potentially exposed more than 2,500 organizations and roughly 434,000 CI/CD pipelines worldwide. The incident was described as one of the largest AI supply-chain compromises reported this year, with the affected dependency creating downstream exposure across enterprise development and deployment environments.
The reported blast radius includes potential access to cloud credentials, source-code repositories, Kubernetes environments, and broader AI infrastructure tied to impacted pipelines. The findings highlight how a compromise in a widely used AI component can propagate through software delivery chains and create enterprise-wide risk well beyond the original package or service.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
9 events from the most recent confirmed update back to the earliest known activity.
Resecurity reported that manifests from the LiteLLM/Trivy credential-harvesting archive identified 898 GitHub owners and 2,038 repositories, and named affected organizations including Microsoft, Azure, IBM, NVIDIA, FedEx, John Deere, TomTom, Deloitte, Bosch, ID.me, and 1inch. The report said the archive reflected capture activity between March 19 and March 24, 2026 and urged all referenced organizations to rotate exposed credentials immediately.
SOCRadar reported that most of the more than 2,500 organizations previously linked to the LiteLLM supply-chain attack were actually compromised earlier through Aqua Security's Trivy scanner. Its analysis of 2,188 organization records found that 95% of observed exposure activity ended before the malicious LiteLLM packages were published on March 24, shifting the primary impact assessment upstream to Trivy.
CloudSEK released a free tool to help organizations determine whether their credentials or infrastructure appear in the dataset tied to the LiteLLM supply-chain attack. It also advised potentially affected organizations to inspect relevant systems, review access logs, and rotate or revoke exposed credentials.
CloudSEK said the LiteLLM compromise was a downstream consequence of the earlier Trivy supply-chain attack and attributed the broader open source compromise activity to TeamPCP. It reported that LiteLLM's CI pipeline automatically installed a compromised Trivy version, leading to the malicious LiteLLM releases.
CloudSEK published research describing a LiteLLM AI supply-chain attack that it said potentially exposed more than 2,500 organizations and 434,000 CI/CD pipelines worldwide. The report said the incident created risks to cloud credentials, source-code repositories, Kubernetes environments, and AI infrastructure.
Hudson Rock said it discovered the LiteLLM exposure after analyzing a 195TB dataset containing stolen credentials, and Ars reported that CloudSEK and Hudson Rock publicly disclosed the exposure on Tuesday and Wednesday. Independent researcher Kevin Beaumont also said he verified the leaked data was legitimate and affected multiple organizations.
In July 2026, the FBI warned that actors linked to TeamPCP were likely to continue abusing credentials stolen during the LiteLLM-related supply-chain compromise long after the initial attack. The warning underscored that simply removing the malicious packages would not eliminate the risk if exposed secrets were not rotated.
Two malicious LiteLLM releases, versions 1.82.7 and 1.82.8, were published to PyPI on March 24, 2026 and remained available for about 40 minutes before being quarantined. The packages used a .pth file to automatically execute credential-stealing code and exfiltrate secrets from infected environments.
On March 19, 2026, attackers used compromised credentials to publish a malicious Trivy v0.69.4 release, part of the TeamPCP supply-chain campaign. The compromised Trivy component was later identified as the upstream stage that enabled theft of LiteLLM CI/CD secrets and the downstream malicious LiteLLM PyPI releases.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
17 references tracked. Mallory keeps watching after this page renders.
securityweek.com
Open sourceresecurity.com
Open sourceheise.de
Open sourcehelpnetsecurity.com
Open sourcecybersecuritynews.com
Open sourcemalware.news
Open sourcecloudsek.com
Open sourceexposure.cloudsek.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security research and incident response reporting highlighted how **AI-enabled tactics** are accelerating cloud compromise and expanding the blast radius into ML systems. Sysdig described an incident in which attackers used **exposed credentials in public AWS S3 buckets** to escalate from initial access to **full administrative privileges in under 10 minutes**, then moved laterally across identities, exfiltrated data from multiple AWS services, and **injected malicious code into AWS Lambda**. The activity also included attempts to monetize access by running AI workloads through **Amazon Bedrock** and attempting **GPU hijacking in EC2**, creating potential for significant cloud cost impact; AWS characterized the root cause as **S3 misconfiguration/credential exposure** rather than an AWS infrastructure flaw. Mitiga reported a separate real-world investigation where a threat actor exploited a **path traversal** flaw in an AI-enabled file upload/summarization web application to overwrite production training data in an S3 bucket feeding an automated **SageMaker retraining pipeline**. The poisoned dataset introduced subtle label inconsistencies and a trigger pattern that, after retraining and deployment, enabled the attacker to reliably induce anomalous model behavior with crafted inputs—effectively a persistent **training data poisoning** compromise of a production AI endpoint. In contrast, Kiuwan’s post is primarily a **general advisory** on AI development supply-chain visibility risks (e.g., unvetted dependencies introduced by LLM coding assistants) and does not describe the same specific incidents or provide incident-specific indicators.
Jun 29, 2026
AI recruiting firm **Mercor** confirmed a security incident after attackers leveraged the **LiteLLM** supply-chain compromise to gain access to its environment. Reports said unauthorized publishes to the project's **PyPI** packages introduced credential-stealing malware designed to harvest API keys, cloud secrets, and tokens from organizations using the open-source LLM gateway. Mercor said it was among thousands of organizations affected, contained and remediated the issue, and brought in external forensic experts as the investigation continued; LiteLLM separately said it was investigating the malicious package activity and released a clean version of the software. Security reporting identified Mercor as the first publicly confirmed downstream victim of the campaign, with stolen credentials allegedly used for lateral movement inside internal infrastructure and the exfiltration of roughly **4 TB** of data. The reportedly stolen data included source code, internal databases, and cloud-stored operational material such as videos and verification workflows. Researchers linked the incident to a broader wave of poisoned developer-tool compromises, including **Trivy** and **KICS**, and warned that related attacks may have impacted more than **1,000 SaaS environments** and potentially hundreds of thousands of machines; separate claims by **Lapsus$** and reporting tying the operation to **TeamPCP** remained unresolved in the cited coverage.
Jun 29, 2026
Datadog Security Labs reported that the **TeamPCP** supply-chain campaign compromised the legitimate PyPI package **LiteLLM**, publishing malicious versions `1.82.7` and `1.82.8` that stole credentials, exfiltrated data, established persistence, and in some cases attempted to spread into Kubernetes environments. The campaign also hit **Telnyx** on PyPI and was linked to earlier compromises involving Trivy, npm packages, Aqua Security repositories, and Checkmarx tooling, with researchers concluding that stolen CI/CD and publishing credentials were reused across ecosystems. Datadog warned that LiteLLM `1.82.8` was especially dangerous because a malicious `.pth` file triggered payload execution when the Python interpreter started, while the Telnyx package executed code at import time and retrieved a second-stage payload hidden in a WAV file. Separately, X41 disclosed a high-severity **sandbox escape** in BerriAI LiteLLM affecting the `main-latest` Docker image, where authenticated users could reach arbitrary code execution through the `/guardrails/test_custom_code` API endpoint. The flaw relied on bypassing regex-based restrictions on custom Python guardrail code using string concatenation and CPython bytecode rewriting to recover unrestricted builtins and call `__import__`, allowing commands to run as the LiteLLM process user, which is **root** in the default Docker deployment. X41 assigned the issue **CWE-94** and a **CVSS 4.0 score of 8.7**, and Datadog advised organizations that installed the malicious LiteLLM releases to treat affected hosts and CI jobs as full credential-exposure events, rotate secrets, hunt for persistence and outbound traffic, and rebuild critical systems from known-good images rather than relying only on package rollback.
Jun 30, 2026