CloudSEK

LiteLLM Supply Chain Poisoning Exposes 195TB of Credentials Across 2500 Organizations

A detailed forensic report from CloudSEK and Hudson Rock reveals that attackers compromised the LiteLLM CI/CD pipeline by poisoning the Trivy security scanner dependency. The malicious Trivy tag allowed theft of PyPI publishing tokens, leading to the upload of tainted LiteLLM versions 1.82.7 and 1.82.8. Within a 40-minute attack window these packages were downloaded over 119,000 times, exfiltrating 195TB of credentials including AWS, Azure, GCP keys, GitHub tokens, SSH keys, Kubernetes configs, and AI provider API keys. NVIDIA and multiple other major technology firms were confirmed among the victims. The incident highlights critical weaknesses in dependency pinning practices and the absence of automated detection for malicious package behavior on PyPI. Experts warn that AI infrastructure components are becoming high-value targets for future supply-chain campaigns.