LiteLLM Supply Chain Breach Exposes Corporate Secrets

Executive Summary

One of the largest AI-related software supply chain breaches of 2026 has been uncovered, targeting the popular open-source AI proxy, LiteLLM. A threat actor group named "TeamPCP" orchestrated a multi-stage attack that resulted in the publication of malicious LiteLLM packages to the PyPI repository. These packages contained a credential-stealing payload, SANDCLOCK Stealer, which harvested vast amounts of sensitive data from compromised developer and CI/CD environments. Security firm Hudson Rock analyzed a 153GB data dump from the attack, attributing the exposed secrets to 2,488 different corporate domains. The incident began with the compromise of a separate open-source tool, Trivy, demonstrating the cascading risk inherent in modern software development practices.

Threat Overview

This sophisticated attack highlights the fragility of the open-source software supply chain. The attack unfolded in several stages:

1. Upstream Compromise: The attackers first compromised the CI/CD pipeline of Trivy, a widely used open-source vulnerability scanner.
2. Cascading Compromise: The LiteLLM project used Trivy in its own CI/CD pipeline without pinning to a specific, trusted version. When the malicious version of Trivy was pulled, it executed within LiteLLM's trusted environment.
3. Credential Theft: The malicious Trivy code stole the PyPI publishing tokens for the LiteLLM project. This is a classic example of T1199 - Trusted Relationship abuse.
4. Malicious Package Publication: Using the stolen tokens, "TeamPCP" published two malicious versions of LiteLLM (1.82.7 and 1.82.8) to the official PyPI repository. This is a direct software supply chain attack, T1195.001 - Compromise Software Dependencies and Development Tools.
5. Payload Execution & Data Theft: Organizations that downloaded and installed these malicious versions inadvertently executed the SANDCLOCK Stealer. The stealer harvested a massive trove of secrets and exfiltrated them to the attackers.

Technical Analysis

The payload delivery mechanism was particularly stealthy. The malicious packages included a Python startup hook (.pth file). This type of file allows code to be executed automatically whenever the Python interpreter starts on a system, meaning the stealer would run even if the LiteLLM library itself was not actively imported or used in a script.

The SANDCLOCK Stealer was designed to be comprehensive, targeting a wide range of high-value developer secrets:

• SSH keys
• Cloud credentials (AWS, Google Cloud, Azure)
• Kubernetes tokens and configuration files
• API keys for AI services (OpenAI, Anthropic)
• Other environment variables and secrets found in CI/CD systems.

This aligns with T1552 - Unsecured Credentials, as the stealer is designed to find and exfiltrate any credentials it can from the compromised environment.

Impact Assessment

The impact of this breach is massive and ongoing. The analysis by Hudson Rock of the 153GB data leak revealed over 433,000 files from the CI/CD and developer environments of 2,488 companies. The exposure of this data has several critical consequences:

• Direct Financial Loss: Stolen cloud and AI service credentials can be abused, leading to huge, unexpected bills (cryptojacking, etc.).
• Further Intrusion: SSH keys and Kubernetes tokens provide attackers with direct, privileged access into corporate networks and production environments.
• Intellectual Property Theft: Access to developer environments can lead to the theft of source code and other proprietary information.
• Loss of Trust: The incident severely damages trust in the compromised open-source projects and the broader ecosystem.

IOCs — Directly from Articles

Cyber Observables — Hunting Hints

Organizations should hunt for the following to identify potential compromise:

Detection & Response

• Dependency Scanning: Use software composition analysis (SCA) tools to scan your projects for vulnerable or malicious dependencies. Ensure your scanner checks for the specific malicious versions of LiteLLM.
• Log Auditing: Immediately audit cloud and application logs for any activity associated with credentials that may have been stored in the compromised environments. D3FEND's Cloud Log Auditing is critical.
• Credential Rotation: This is the most urgent response action. All secrets, keys, and credentials present in developer and CI/CD environments must be assumed compromised and should be rotated immediately.
• System Forensics: Analyze systems that had the malicious packages installed to determine the full extent of the compromise.

Mitigation

• Pin Dependencies: Never install dependencies without specifying a known-good version. Pinning dependencies (e.g., litellm==1.82.6) in your requirements.txt or other package manifest files prevents the automatic installation of newer, potentially malicious versions. This is a core principle of M1051 - Update Software in a supply chain context.
• Vet Dependencies: Use tools like pip-audit or other SCA scanners to check for known vulnerabilities in your dependencies before installation.
• Secure CI/CD Pipelines: Harden your CI/CD environment. Limit the permissions of build runners, use ephemeral build environments, and store secrets in a secure vault rather than in environment variables or configuration files. This relates to M1026 - Privileged Account Management.
• Artifact Integrity: Use package repositories that support signature verification or host a private, vetted mirror of public repositories to have greater control over the packages being used.