LiteLLM Supply Chain Attack Exposed Secrets Across 2,500+ Organizations

LiteLLM Supply-Chain Attack – Technology, Banking and Healthcare the Most Affected

The SANDCLOCK LiteLLM supply-chain attack exposed credentials across 2,038 repositories, affecting technology, finance, healthcare, retail and more. Resecurity (USA) estimated the most affected sectors by the “SANDCLOCK” backdoor, which was planted as a result of the code repository compromise. According to cybersecurity experts, LiteLLM / TeamPCP Supply-Chain Attack will have long-lasting consequences. By compromising a […] This article has bee…

LiteLLM Supply-Chain Attack Exposed Credentials Across 2,500 Organizations

A March supply-chain attack involving malicious versions of the LiteLLM Python package may have exposed credentials belonging to more than 2,500 organizations and hundreds of thousands of CI/CD pipelines, according to security researchers. Attackers published two compromised versions of LiteLLM, a widely used AI gateway, after obtaining access to the project’s PyPI account. The malicious releases were designed to steal cloud keys, repository tok…

From CI Pipeline to Ransomware & Breaches: 6 High-Profile Breaches in the LiteLLM/Trivy Attack

From CI Pipeline to Ransomware Leak Site: 6 High-Profile Breaches in the LiteLLM Attack By the Hudson Rock Threat Intelligence Team Following our initial report detailing the largest AI supply chain breach of the year, Hudson Rock’s threat intelligence team has continued to analyze the catastrophic fallout of the LiteLLM and Trivy supply chain campaign. As part of our global ethical disclosure efforts, we have reconstructed the attack paths like…

The LiteLLM Breach: 153 GB of AI and Cloud Credentials Exposed

In March 2026, a threat actor group called TeamPCP compromised the CI/CD pipeline of Trivy, one of the most widely used open source vulnerability scanners in the industry. This access was used to steal the publishing credentials of LiteLLM, another very popular open source AI proxy gateway. Five months later the consequences of that single […] The post The LiteLLM Supply Chain Attack: How a Poisoned Scanner Exposed 2,000+ Organizations’ AI and C…

LiteLLM Supply Chain Attack Exposed Secrets Across 2,500+ Organizations

A major software supply chain attack targeting LiteLLM has exposed credentials and CI/CD data linked to more than 2,500 organizations, underscoring how deeply AI infrastructure has become embedded in enterprise development environments. New analysis from SOCRadar indicates the incident was significantly broader than the roughly 40-minute window in March 2026 when malicious LiteLLM packages appeared on the Python Package Index, or PyPI. Researche…