The LiteLLM Supply Chain Attack: What Happened, Why It Matters, and How to Respond

The March LiteLLM supply chain attack compromised credentials across over 2,500 organizations, exposing cloud access tokens, SSH keys, Kubernetes tokens, and LLM API keys. For AI builders, this is a direct threat to the infrastructure that powers AI products.

The Attack Chain: How TeamPCP Compromised LiteLLM

The threat group TeamPCP breached LiteLLM, an open-source tool widely used to connect applications with AI models. Malicious versions were available on PyPI for just 40 minutes, yet that was enough to potentially expose 434,000 CI/CD pipelines, according to CloudSEK. The attack was linked to an earlier compromise of Trivy, where abuse of a trusted vulnerability scanner in CI/CD pipelines facilitated credential theft and poisoned LiteLLM's PyPI release chain.

Exposed data included AWS, Google Cloud, and Microsoft Azure credentials, SSH keys, Kubernetes tokens, .env files, CI/CD secrets, and LLM API keys and gateway configurations. Attackers could scrape values directly from /proc//mem, including what GitHub Actions tries to mask.

Why This Is a Direct Threat to AI Builders

For teams running AI products, compromised LLM API keys are the highest risk. Attackers with valid credentials can log into corporate cloud environments without needing to break in again. As CloudSEK noted, malicious activity performed through legitimate credentials is much harder for security teams to detect. Because LiteLLM acts as a gateway to the entire AI stack, a breach here gives attackers access to the credentials an organization's entire AI infrastructure relies on.

Even after the malicious package was removed, the risk persists. Credentials copied while the compromised package was active remain valid until the organization rotates or revokes them. This means organizations exposed in March could still be vulnerable months later.

Practical Steps: What to Do Now

CloudSEK has released a free exposure-checking tool. If your credentials appear in its dataset, immediately review access logs and rotate or revoke potentially exposed keys and tokens. Do not assume that removing the malicious LiteLLM version is sufficient.

For ongoing protection, treat any open-source tool that handles credentials as a critical security boundary. Implement continuous monitoring for anomalous activity tied to leaked tokens, especially across your AI gateway and cloud infrastructure. Pin package versions, verify checksums, and use short-lived credentials with automatic rotation.

The Limits of What We Know

Exposure of credentials does not prove actual compromise. CloudSEK stressed that the presence of credentials in the leaked dataset is not confirmation that attackers used them. However, the scale of the LiteLLM supply chain attack is unprecedented, and the potential for damage remains substantial until all exposed credentials are rotated.