Terabytes of credentials exposed in LiteLLM supply-chain attack

The LiteLLM compromise was not an isolated incident but part of a broader campaign by TeamPCP targeting critical infrastructure in the open source software supply chain. The group previously compromised Trivy, a widely used vulnerability scanner, and also infected KICS and the Telnyx Python SDK. The attack exploited a weakness common across many organizations: the integration of third-party open source tools into deployment pipelines without sufficient isolation or monitoring. When a single upstream dependency is infected, the malware spreads to every downstream user within minutes—in this case, 2,500 organizations in 40 minutes.

A key vulnerability in the incident was credential management at both the tool provider and the victim organizations. CloudSEK and Hudson Rock noted that CI/CD pipelines are often configured to store credentials as environment variables without additional safeguards, and that many organizations failed to rotate these secrets even after the breach was disclosed. Independent security researcher Kevin Beaumont confirmed that credentials exposed in March remained active months later at some of the largest U.S. technology companies, suggesting that organizational response has been inadequate. The researchers also flagged a secondary lesson: Trivy developers rotated a compromised automation token but failed to fully revoke it, creating a 20-day window during which attackers could continue to inject malicious code into downstream projects.