LiteLLM Supply-Chain Attack Exposed CI/CD Secrets at Nearly 2,500 Organizations
Summary
Hudson Rock says malicious LiteLLM versions 1.82.7 and 1.82.8 led to the theft of CI/CD secrets across 2,488 attributed corporate domains. The article describes the attack path, exposed data, and recommended response.
Key points
- The article says attackers compromised Trivy’s GitHub Actions pipeline and used access to LiteLLM’s CI/CD environment to steal PyPI publishing tokens.
- The malicious LiteLLM versions 1.82.7 and 1.82.8 reportedly used a Python .pth startup hook to run payloads.
- The payload allegedly harvested environment variables and configuration files, attempted Kubernetes lateral movement, and installed a systemd backdoor.
- Hudson Rock says its analysis of a 153GB archive identified 118,829 CI runner dumps associated with 2,488 corporate domains.
- Reportedly exposed data included cloud credentials, Kubernetes and source-control tokens, database passwords, and API keys.
- The article recommends auditing for the affected LiteLLM versions, rotating accessible credentials, reviewing cloud and Kubernetes logs, and checking for suspicious .pth files and systemd services.
Article Details
- Victim Organization
- LiteLLM and downstream organizations whose CI/CD pipelines ran the compromised package
- Incident Type
- Software supply-chain compromise involving a poisoned Trivy GitHub Actions pipeline and malicious LiteLLM package versions 1.82.7 and 1.82.8
- Disclosure Date
- 2026-08-12
- Data Types Exposed
- Environment variables and live environment memory
- Cloud credentials and keys
- Kubernetes configuration and service account tokens
- Database passwords
- Third-party API keys
- GitLab and GitHub personal access tokens
- Internal configuration files
- Deployment tokens
- Internal JWTs
- NPM tokens
- Affected Records
- 118,829 attributed CI runner dumps across 2,488 corporate domains, according to Hudson Rock's analysis; the archive contained 433,909 files.
- Affected Data Size
- 153GB RAR archive
- Operational Impact
- The malicious packages harvested environment variables, configuration files, credentials, and other secrets; attempted lateral movement across Kubernetes clusters; and installed a persistent systemd backdoor. The source reports exposure of secrets from affected pipelines but does not quantify resulting downstream misuse.
- Ransom Or Extortion
- None reported
- Claim Status
- confirmed