LiteLLM Supply Chain Attack Exposed 434,000 CI/CD Pipelines: Rotate Your Cloud Credentials Now

The LiteLLM supply chain attack was a cascading compromise. TeamPCP did not attack LiteLLM directly. They attacked Aqua Security's Trivy open-source vulnerability scanner first.

Trivy's GitHub Actions pipeline was compromised on March 19, 2026, when TeamPCP used stolen credentials to publish a malicious Trivy version. LiteLLM's build pipeline installed Trivy automatically as a dependency scanner, giving the poisoned Trivy scanner read access to the LiteLLM build runner environment. From that position, TeamPCP extracted LiteLLM's PyPI publishing tokens and used them to push two malicious releases, 1.82.7 and 1.82.8, to the Python Package Index on March 24.

The malicious packages deployed SANDCLOCK in three stages. First, a Python .pth file named litellm_init.pth dropped into site-packages, ensuring the payload executed at every Python startup without any import statement. Second, the payload escalated to root and began a comprehensive credential harvest: environment variables, SSH keys, cloud credentials from .aws/credentials and the EC2 instance metadata service, Kubernetes service account tokens from .kube/config, database connection strings, and masked secrets pulled from process memory via /proc/pid/mem. Third, the harvested data was AES-256 encrypted under TeamPCP's RSA-4096 public key, packaged as tpcp.tar.gz, and uploaded to models.litellm.cloud. A systemd user service named sysmon.service provided persistent C2 backdoor access after credential exfiltration.

The 40-minute live window is deceptive. LiteLLM packages cached in CI/CD artifact repositories, Docker layer caches, and dependency lock files continued to install the malicious version for weeks after PyPI quarantine in environments that did not pin versions or update lock files.

CloudSEK's analysis of the 153GB archive identified 118,829 CI runner environment dumps attributable to 2,488 corporate domains. Named organizations with confirmed credential exposure include AWS, Samsung, Cisco, Salesforce, NVIDIA, Volkswagen, Microsoft, FedEx, S&P Global, John Deere, Epic Games, Orange, TomTom, BT Group, ServiceNow, Deloitte, Siemens, and Zscaler.

These are not unverified claims. The archive contains structured credential files with domain attribution traceable to specific CI/CD job outputs. Hudson Rock researchers separately validated the credential data by testing samples and found that a significant proportion remained active months after the initial compromise, confirming that affected organizations did not treat the incident as a credential rotation event requiring immediate action.

The scope extends beyond named organizations. LiteLLM is used as an AI API gateway by startups, research institutions, financial services firms, and government contractors that aggregate multiple AI provider endpoints behind a single interface. Every organization using LiteLLM in a CI/CD pipeline, rather than in a static deployment, is a potential victim. The 2,488 domains represent confirmed exposure, not the full population of organizations whose pipelines installed 1.82.7 or 1.82.8 during the 40-minute window or from cached artifact repositories afterward.

The FBI issued FLASH advisory FLASH-20260702-01 in July 2026, warning of ongoing weaponization risk from the stolen credential archive, indicating that intelligence agencies had visibility into active use of the harvested data.

TeamPCP emerged as a distinct threat actor in late 2025, specializing in cascading supply chain attacks against AI and developer tooling ecosystems. Their operational pattern follows a specific sequence: identify a widely depended-upon component in the AI/ML build pipeline, compromise an upstream dependency using surviving credentials, extract downstream publishing tokens, and inject credential stealer payloads into high-download-count packages.

The LiteLLM attack was TeamPCP's most significant operation, but not their only one. They conducted a parallel supply chain attack against TanStack npm packages in May 2026, using the same SANDCLOCK credential harvesting payload adapted for the Node.js ecosystem. Zscaler ThreatLabz analysis of the npm attack found overlapping infrastructure and payload encryption keys linking the two campaigns definitively to TeamPCP.

TeamPCP's preferred exfiltration infrastructure uses typosquatted domains and CDN endpoints that blend with legitimate traffic. The models.litellm.cloud domain mimicked LiteLLM's own infrastructure URL schema, reducing the likelihood of detection in environments that filtered by domain reputation rather than full URL inspection. When primary exfiltration failed, the malware created public GitHub release assets in victim repositories under the pattern tpcp-docs/docs-tpcp before deletion.

The North Korea-linked supply chain attack that hid 1,700 malicious packages across developer tools used comparable cascading compromise techniques, targeting developers with access to high-value enterprise infrastructure, confirming that supply chain attacks against AI tooling are now a repeatable, operationalized capability across both state-sponsored and criminal actors.

Detection of the LiteLLM supply chain attack requires searching across three surfaces: package version history in dependency files, file system artifacts on affected runners, and network telemetry from CI/CD environments around March 24, 2026. Start with package version history, it is the fastest path to confirming exposure. Any environment that installed 1.82.7 or 1.82.8 must be treated as fully compromised until credential rotation is complete.

The persistence file litellm_init.pth is the most actionable hunting indicator. Its presence in Python site-packages confirms active SANDCLOCK infection regardless of whether the malicious package was subsequently removed. Run: find /usr/lib/python3*/site-packages/ -name 'litellm*.pth'. The systemd user service named sysmon.service and its associated .config/sysmon/sysmon.py backdoor file should also be hunted across all Linux runners and containers that ran Python during the exposure window.

Network telemetry showing outbound requests to models.litellm.cloud or checkmarx.zone from CI/CD runners during the March 24 window is definitive confirmation of active exfiltration. Retroactive SIEM queries against DNS logs and network flow data from that date should surface any affected runners.

For environments that were also affected by the 108 malicious Chrome extensions stealing OAuth2 tokens, the credential classes overlap significantly. If both attack surfaces were active, treat all authentication tokens, not just cloud keys, as compromised.

Two Sigma rules covering the LiteLLM supply chain attack are in the SigmaHQ emerging threats repository, written shortly after the March 2026 disclosure by Swachchhanda Shrawan Poudel at Nextron Systems. Both target Linux environments, reflecting the attack's primary impact surface: CI/CD runners and containerized build environments.

Deploy both rules against Linux file event telemetry (Auditd, Sysmon for Linux, or Falco) and Linux process creation logs. The file event rule fires when Python creates the SANDCLOCK sysmon persistence files. The process creation rule fires on the actual exfiltration commands including the curl upload to models.litellm.cloud and the tar archive creation. Retroactive queries against March 24, 2026 log archives are the immediate priority before forward-looking deployment.

Credential rotation is the only remediation that closes the risk from the LiteLLM supply chain attack. Removing the malicious package or the litellm_init.pth persistence file stops future credential theft but does not invalidate secrets already harvested and exfiltrated to TeamPCP's servers in March 2026. Treat every secret accessible to affected CI/CD runners as compromised and rotate before end of day.

The LiteLLM supply chain attack demonstrates a structural risk in modern AI infrastructure. LiteLLM functions as an aggregation layer: it sits between enterprise applications and AI providers, routing requests to OpenAI, Anthropic, Cohere, and other endpoints through a unified gateway. This architecture means LiteLLM's CI/CD environment has access to API keys for every AI provider an organization uses, plus the cloud infrastructure credentials needed to deploy and scale the gateway itself.

TeamPCP selected LiteLLM specifically because of this credential density. A single compromised LiteLLM CI/CD runner contains more high-value secrets than most other targets: cloud provider credentials, AI provider keys, database connection strings, and Kubernetes configurations all concentrated in one environment. The 40-minute live window on PyPI was sufficient because LiteLLM's 95 million monthly downloads ensured rapid distribution before quarantine.

The broader lesson applies beyond LiteLLM. Any AI gateway, inference framework, or ML pipeline tool that processes cloud credentials and AI provider keys in its build environment presents the same credential density risk. Dependency pinning, package hash verification, and software composition analysis tools that validate hashes at install time are the controls that would have prevented automatic installation of 1.82.7 and 1.82.8 in environments that had previously verified 1.82.6.

The FBI FLASH advisory issued in July 2026 indicates that harvested credentials from the March attack are being actively weaponized, not stockpiled. Five months after the initial compromise, the risk is current. For any organization that ran LiteLLM in a CI/CD pipeline during the March 2026 window and has not rotated credentials, the exposure is active today.