LiteLLM was indirectly compromised via the Trivy open source vulnerability scanner supply chain attack. The threat actor TeamPCP exploited a leaked token to inject malicious code into LiteLLM's build and release pipeline, pushing tainted versions 1.82.7 and 1.82.8 to PyPI. The malicious payload executed on every Python invocation without explicit import, allowing attackers to harvest sensitive information including package publishing credentials, cloud keys, SSH keys, tokens, environment variables, runtime data, and AI provider keys. The compromised packages were live for approximately 40 minutes, sufficient time to propagate the malware and expose 434,000 CI/CD pipelines and over 2,500 organizations globally. The incident highlights the cascading risk in software supply chains and the criticality of securing build systems and tokens. CloudSEK recommends validating and rotating all potentially compromised secrets and reviewing logs to assess exposure.

The attack exposed a wide range of sensitive secrets and credentials across thousands of organizations and hundreds of thousands of CI/CD pipelines. This exposure could enable attackers to take over accounts, steal data, inject malicious code, maintain persistence, move laterally within networks, disrupt services, and deploy further malware. The compromised secrets include package publishing credentials, cloud service keys, SSH keys, tokens, environment variables, runtime data, and AI provider keys. The broad impact affects major global enterprises and critical infrastructure sectors, increasing the risk of follow-on attacks and data breaches.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Organizations should assume all secrets accessible to the compromised LiteLLM versions (1.82.7 and 1.82.8) are compromised. They should immediately validate and rotate all potentially exposed credentials, including service accounts and sessions. Logs should be reviewed to determine the scope and timeframe of exposure. Removal of the malicious package versions from environments is necessary, but not sufficient due to potential credential theft. Strengthening token management and securing build pipelines to prevent token leakage is critical to avoid similar supply chain attacks.