Security researchers at CloudSEK say the recent LiteLLM supply chain compromise may have exposed more than 2,500 organizations and over 434,000 CI/CD pipelines, making it one of the broadest downstream software supply chain incidents involving AI infrastructure to date.
The findings build on the previously disclosed compromise of the LiteLLM project, which itself stemmed from an earlier attack targeting Aqua Security’s Trivy vulnerability scanner. According to CloudSEK, the attackers never targeted LiteLLM directly. Instead, they compromised the project’s automated build pipeline after it installed a malicious Trivy release.
Attack chain reached thousands of organizations
CloudSEK’s analysis describes a cascading supply chain attack in which a compromised Trivy package ultimately resulted in malicious LiteLLM releases being published to PyPI. The affected versions, 1.82.7 and 1.82.8, reportedly contained code that executed automatically whenever Python started, allowing the malware to collect sensitive information from systems where the packages were installed.
Although the malicious LiteLLM releases were available for only roughly 40 minutes, CloudSEK says that was sufficient for automated build systems, dependency managers, CI/CD pipelines, developer workstations, and cached environments to retrieve the packages.
Based on its reconstruction of the attack, CloudSEK estimates that more than 434,000 CI/CD pipelines and over 2,500 organizations were potentially exposed during that window.
The incident follows a broader series of software supply chain compromises attributed to TeamPCP. BreachNews has previously covered the group’s Bitwarden CLI compromise and wider supply chain activity affecting developer tooling and open source infrastructure.
Exposure does not equal confirmed compromise
CloudSEK stressed that these figures represent reconstructed exposure rather than confirmed compromise. The organizations identified in the research should not be interpreted as evidence that every environment was successfully breached or that credentials were stolen.
The researchers say each organization should independently verify whether the affected LiteLLM versions were present in their environments and determine whether any secrets may have been exposed.
Secrets at risk
According to the report, any credentials accessible to the compromised LiteLLM process should be treated as potentially exposed. This includes cloud credentials, SSH keys, package publishing tokens, AI provider API keys, environment variables, runtime secrets, and other authentication material available during execution.
CloudSEK warns that attackers could potentially leverage stolen secrets to hijack cloud accounts, access source code repositories, move laterally across environments, establish persistence, inject malicious software into development pipelines, or disrupt services.
The company recommends rotating all potentially exposed credentials, reviewing authentication logs, validating service accounts, terminating active sessions where appropriate, and conducting a full investigation into systems that may have installed the affected releases.
Major organizations appeared in reconstructed exposure list
CloudSEK’s research includes a reconstructed exposure list containing numerous large organizations whose development environments may have interacted with the compromised packages. Examples include NVIDIA, AWS, Samsung, Salesforce, Cisco, ServiceNow, Siemens, FedEx, Volkswagen, HP, Deutsche Bahn, Orange, Regeneron Pharmaceuticals, London Stock Exchange Group, NGINX, Zscaler, and Accenture Federal Services.
CloudSEK emphasized that inclusion in the reconstructed exposure dataset does not indicate confirmed compromise of those organizations.
AI supply chains becoming attractive targets
The researchers argue that AI infrastructure is becoming an increasingly valuable target because it sits at the intersection of identity, cloud infrastructure, automation, and sensitive enterprise data.
Rather than viewing the LiteLLM incident as an isolated package compromise, CloudSEK says it demonstrates how compromising a single dependency can ripple across thousands of downstream environments in a matter of minutes. The company believes future software supply chain attacks are likely to increasingly focus on AI tooling and infrastructure because of the privileged access these systems often possess.
The findings also reinforce concerns raised in an earlier FBI warning about TeamPCP supply chain attacks and extortion activity, which highlighted the risks posed by compromises of trusted developer tools and automated build environments.
Alt text: Digital illustration of a glowing blue software supply chain breaking at a red compromised link, with warning symbols and circuit patterns representing a cascading supply chain attack.
