LiteLLM Supply-Chain Attack Exfiltrates 195TB Credentials from 434000 CI/CD Pipelines
A supply-chain compromise of LiteLLM via Trivy exposed 195TB of secrets across 2500 organizations and 434000 pipelines. Evidence from Hudson Rock and CloudSEK confirms the data includes production keys from major enterprises. The root cause was inadequate package signing and secret hygiene during rapid AI adoption.
The attack chain started when TeamPCP compromised Trivy, allowing malicious LiteLLM, KICS, and Telnyx SDK versions to be published on PyPI. These packages injected memory-scraping code that captured environment variables, cloud keys, SSH keys, and Kubernetes secrets before exfiltrating them. The window closed after 40 minutes once the malicious uploads were detected and removed.
Hudson Rock confirmed the scale by analyzing the 195TB dataset, while CloudSEK mapped exposed tokens to 434000 CI/CD pipelines. Verified victims include Nvidia, AWS, Samsung, Cisco, Salesforce, and Siemens. Independent researcher Kevin Beaumont cross-checked samples and found legitimate secrets from multiple large organizations, many tied to AI workloads.
The incident reveals that rushed AI tooling deployments bypassed standard secret management and package signing controls. TeamPCP succeeded through existing DevOps gaps rather than novel AI exploits. Organizations must now treat all exposed tokens as compromised and enforce immediate rotation plus signed package verification on PyPI to close the vector.
CloudSEK: 12% of exposed Azure and AWS keys will trigger anomalous access logs within 21 days.
Sources (2)
- [1]Ars Technica Report(https://arstechnica.com/security/2026/08/terabytes-of-credentials-leaked-in-massive-supply-chain-attack/)
- [2]Hudson Rock LiteLLM Breach Analysis(https://hudsonrock.com/litellm-195tb-dump)