The massive supply-chain attack that compromised LiteLLM in the spring affected more than 2,500 companies and exposed about 434,000 CI/CD pipelines, with victims ranging from top-tier IT and AI companies to cybersecurity firms, SaaS, and enterprises.
It rolled up a lot of victims, but also was a high-profile example of the growing trend of threat actors targeting companies’ AI infrastructure layer that is increasingly becoming connected to everything within their environments, according to CloudSEK threat researchers.
The March attack on LiteLLM, a gateway and toolkit that lets developers call more than 100 large language model (LLM) providers – including Anthropic, Google’s Gemini, and Amazon Web Services’ (AWS’) Bedrock – was the result of the threat group TeamPCP earlier that month compromising Aqua Security’s Trivy open source security vulnerability scanner and its associated GitHub Actions.
LiteLLM was compromised by TeamPCP but never directly attacked, according to CloudSEK’s researchers. Instead, LiteLLM became part of a much broader campaign by the threat group after its CI pipeline installed the compromised Trivy scanner, leading to the publishing of releases 1.82.7 and 1.82.8 that included malicious code to the Python Package Index (PyPI) repository.
“Trivy, then the build system, then the LiteLLM release: one un-revoked token, three tools deep,” the CloudSEK researchers wrote in a report. “That chain is what turns a single credential leak into ecosystem-wide exposure.”
Only 40 Minutes Were Needed
The two malicious LiteLLM packages remained on PyPI for about 40 minutes, but within that time, the damage was done. The researchers noted that automated build systems can compress time and that once an artifact containing malicious code gets into a registry, it can get copied quickly in scheduled jobs, dependency resolvers, developer laptops, and other tools.
Given that, the threat remains even after the packages are removed, a key reason behind CloudSEK publishing the lists of compromised companies and affected pipelines.
“We are sharing this openly so that every affected organization can act proactively,” they wrote, adding that the “threat is still live. … Early awareness is the strongest defense; knowing you were impacted lets you rotate credentials, close the exposure, and harden before the next campaign hits.”
Widespread Compromise
The warning echoes an advisory issued by the FBI in July, which pointed to the TeamPCP’s compromise of “supply chain entry points” that not only included Trivy and LiteLLM, but also KICS – an open source code analysis tool created by Checkmarx – and the Telnyx Python SDK.
“These tools are commonly integrated into enterprise development continuous integration (CI)/continuous delivery (CD) pipelines, cloud infrastructure, and security workflows,” the FBI wrote. “By weaponizing these supply chain entry points, the threat actors were able to introduce malicious code into victim environments at scale.”
The agency also wrote that TeamPCP has collaborated with other threat groups and run extortion campaigns – publishing victim names on leak sites and threatening to disclose stolen data – and urged victim organizations to “treat exfiltrated data and credentials as a persistent risk, as affiliated threat actors are likely to weaponize them long after the initial compromise.”
Stealing Credentials, API Keys, and Other Info
The malware distributed by TeamPCP included CanisterWorm, which harvests such sensitive information as cloud access tokens, credentials, API keys, and similar authentication material for cloud services like AWS, Google Cloud Platform, and Microsoft Azure, and SandClock, another info-stealer that targets AWS credentials, Kubernetes service account tokens, and cryptocurrency wallet data.
There’s also Mini Shai-Hulud, a self-replicating worm that targets npm and PyPI repositories for supply chain attacks, and Miasma, a Shai-Hulud variant that also self-propagates across npm and PyPI stealing credentials and damaging configuration files.
“The loot was encrypted and shipped to a typosquatted domain,” the researchers wrote. “Where exfiltration failed, the malware created a public repository inside the victim’s own GitHub account and uploaded the stolen data there as a release asset, meaning some organizations were leaking their own secrets into public view without knowing it.”
High-Profile Victims
The CloudSEK Threat Intelligence unit was able to access a dataset holding the information of victims, according to the researchers. The list includes a large number of well-known companies, including such tech, cloud, and SaaS companies as Nvidia, Intel, Zscaler, AWS, Cisco Systems, Salesforce, and ServiceNow.
There also are numerous enterprises outside of IT, from John Deere and Airbus U.S. to FedEx, Volkswagen, Bayer, and Deloitte.
The researchers cautioned that the company and pipeline numbers just refer to exposure to the threat, not necessarily that they’ve been compromised.
Targeting AI Infrastructure
They also expect that AI infrastructure will increasingly become a target of cybercriminals, noting that such systems are becoming key junctions between data, identity, compute, and autonomous action. This trend would echo what’s happened in the past.
“In the industrial age, rail junctions became strategic targets because many supply routes met at one point,” the researchers wrote. “AI gateways, agent runtimes, MCP servers, and vector stores are becoming the junctions of digital operations. The [LiteLLM] incident was not only a software supply chain breach that happened to involve an AI product. It demonstrated that compromising an AI control point can expose the identities and systems around it.”