cyber.hendryadrian.com
Security Report · cloudsek.com

CloudSEK finds potential exposure of 2,500 companies in LiteLLM supply-chain attack

· Original article ↗

Summary

CloudSEK says its reconstructed dataset links more than 2,500 companies and 434,000 CI/CD pipelines to exposure from the March 2026 supply-chain attack involving LiteLLM. The figures indicate potential exposure, not confirmed compromise.

Key points

  • CloudSEK attributes the broader campaign to TeamPCP and reports that compromised security tooling, including Trivy, fed malicious LiteLLM releases 1.82.7 and 1.82.8 to PyPI.
  • The malicious package used a Python .pth file that ran at interpreter startup, allowing it to collect credentials available to affected systems.
  • Potentially accessible data included cloud and AI provider keys, repository tokens, SSH keys, Kubernetes credentials, CI/CD secrets, and environment variables.
  • CloudSEK estimates more than 2,500 companies and 434,000 pipelines were potentially exposed; it cautions that these figures do not prove successful compromise or credential theft.
  • The report says the affected package versions were available for about 40 minutes, but copied credentials could remain usable after package removal.
  • CloudSEK recommends validating exposure, isolating affected systems, rotating credentials accessible to affected processes, rebuilding clean environments, and reviewing audit logs for suspicious activity.

Article Details

Publisher
CloudSEK
Report Period
March 2026 incident; report references advisories through July 2026
Scope
Reconstructed organization and CI/CD pipeline exposure associated with the March 2026 supply-chain cascade involving Trivy, Checkmarx KICS, and LiteLLM.
Sample Size
More than 2,500 companies and 434,000 potentially exposed CI/CD pipelines; these figures describe reconstructed exposure, not confirmed compromise.
Key Statistics
  • More than 2,500 companies in CloudSEK's reconstructed exposure dataset.
  • 434,000 CI/CD pipelines potentially exposed.
  • Affected PyPI packages were live for approximately 40 minutes.
  • A leaked automation token reportedly left an approximately 20-day window for the attacker to force-push malicious code over Trivy's published version tags.
Recommendations
  • Validate potential exposure privately; notify affected organizations and review credentials and logs.
  • Identify use of LiteLLM versions 1.82.7 and 1.82.8; isolate affected runners, hosts, images, and caches.
  • Rotate credentials accessible to affected processes, including cloud, repository, registry, Kubernetes, SaaS, database, and AI credentials.
  • Rebuild affected environments from known-clean sources and review cloud, source-control, package-registry, and cluster audit logs.
  • Pin dependencies and GitHub Actions to verified hashes, shorten credential lifetime and scope, and continuously monitor CI/CD behavior and third-party AI dependencies.

Threat Actors

TeamPCPPublic reporting attributes the broader supply-chain campaign to this financially motivated cluster; the article says it compromised trusted security and developer tooling and used credential-stealing payloads.

Malware

SANDCLOCKOn every compromised CI runner, TeamPCP's stealer (tracked by Google as SANDCLOCK) escalated to root and swept:

Vendors

CloudSEKis believed to be the largest supply chain attack targeting AI infrastructure by compromising LiteLLM. CloudSEK Threat Intelligence was able to get access to the victim information and is disclosing the details ofGoogleOn every compromised CI runner, TeamPCP's stealer (tracked by Google as SANDCLOCK) escalated to root and swept:

Products

AIVigilAttacks on AI infrastructure are on the rise and that is exactly what CloudSEK AIvigil, our AI Attack Surface Monitoring platform, is built to prevent. AIvigil continuously discovers, monitors, and secures exposed AIGitHub Actions.env files and CI/CD secrets — including the values GitHub Actions tries to mask, scraped directly from /proc/<pid>/memLiteLLMwhat is believed to be the largest supply chain attack targeting AI infrastructure by compromising LiteLLM. CloudSEK Threat Intelligence was able to get access to the victim information and is disclosing thePyPIapproximate period the affected PyPI

Tools

Checkmarx KICSexposures associated with the March 2026 supply-chain cascade involving compromised Trivy, Checkmarx KICS, and LiteLLM buildsTrivyThe release process's trusted security scanner (Trivy) was taken over. A leaked automation token , rotated but not fully revoked , left an approximately 20-day window in which the attacker force-pushed malicious code

Related Articles