LiteLLM Supply Chain Attack Hit 2,500+ Orgs

Two malicious releases of LiteLLM — the widely-used open-source AI proxy library — sat on PyPI for approximately 40 minutes in March before being pulled. That window was enough: threat intelligence firm CloudSEK has now mapped exposure to more than 2,500 organizations.

The attack vector runs through Trivy. Attackers who compromised the popular container vulnerability scanner used that access as a stepping stone to backdoor LiteLLM — a supply chain pivot that extended the blast radius well beyond anyone running Trivy directly.

What the malware exfiltrated

The credential-stealing payload was not subtle. CloudSEK obtained a dataset of roughly 434,000 files the attackers captured from infected systems. The haul included:

• Cloud provider API keys (AWS, GCP, Azure)
• SSH private keys
• Kubernetes service account tokens
• Database passwords and connection strings

Any environment that installed an affected LiteLLM version via pip during the March exposure window — a CI/CD pipeline, a Docker build, a developer workstation — may have sent all of the above outbound.

What to do right now

If your environment installed LiteLLM via PyPI in March 2026, treat every credential on those systems as compromised until rotated. Priority order by lateral-movement risk:

1. Cloud IAM keys and service account credentials — rotate first; cloud access is the highest-impact lever an attacker has from this dataset
2. SSH private keys — rotate and audit authorized_keys on every host those keys could reach
3. Kubernetes tokens — revoke and reissue; review RBAC bindings for what those service accounts were permitted to do
4. Database passwords — rotate and pull connection logs for anomalous query patterns

To scope your exposure: check pip install logs, container build histories, and requirements.txt / pyproject.toml lockfiles for the affected version strings. If you’re running LiteLLM in production today and cannot confirm clean provenance, rebuild from a verified base image.

The upstream problem

The Trivy compromise is the part worth flagging to your security team beyond the immediate LiteLLM response. Security tooling in CI/CD pipelines holds elevated trust by design — it scans code, accesses live environments, and the build process treats it as authoritative. When that tooling is compromised, it becomes an ideal pivot for supply chain attacks against every project downstream.

This isn’t new as an attack class. But 2,500+ organizations from a 40-minute exposure window on a single PyPI package is a concrete data point on how quickly blast radius scales when the target is positioned upstream in the software supply chain.

Verify your installed Trivy version and inspect your pipeline configuration for any outbound network access Trivy shouldn’t need.

Sources: SecurityWeek | The Hacker News