A supply-chain attack is a cyberattack that targets a third-party software provider to gain unauthorized access to the systems of its customers. In this instance, attackers compromised a version of LiteLLM—an open-source tool used to streamline AI development—on the Python Package Index (PyPI), allowing them to harvest credentials from organizations using the software.
Researchers from CloudSEK and Hudson Rock identified that a 40-minute window in March allowed attackers to exfiltrate massive amounts of sensitive data. This breach included cloud keys, Kubernetes secrets, SSH keys, and AI provider credentials affecting over 2,500 organizations, including major entities like Microsoft, Amazon, and Cisco (CloudSEK, 2026; Hudson Rock, 2026).
A supply-chain attack works by injecting malicious code into a trusted piece of software, which then executes when developers download or run that software. In the LiteLLM incident, attackers uploaded a compromised version of the package to the official Python Package Index (PyPI), the standard repository for Python software.
When developers installed or updated their LiteLLM dependencies during the specific 40-minute window, the malicious code executed automatically. This code was designed to scrape environment variables and configuration files, effectively "vacuuming up" any hardcoded credentials, API keys, or tokens stored within the development environment. Because LiteLLM is frequently used to manage connections between AI models and internal infrastructure, the compromised software had high-level access to sensitive cloud environments and private repositories.
The breach exposed a wide range of authentication tokens and secrets, which are the "keys to the kingdom" for modern cloud-based software development. According to reports from security firms CloudSEK and Hudson Rock, the stolen data included cloud access keys (such as AWS and Azure), repository tokens (GitHub/GitLab), SSH keys for server access, and Kubernetes secrets used for container orchestration (CloudSEK, 2026).
Because developers often store these credentials in plaintext within their environment variables or local configuration files to allow LiteLLM to function, the malware was able to copy them with minimal effort. If these keys were not rotated immediately, an attacker could potentially use them to move laterally through an organization's network, access private databases, or even deploy further malicious code into production environments.
Keep exploring
More from GroundworkTo determine if you were affected, you must audit your software supply chain logs and investigate any machines that pulled LiteLLM updates during the March timeframe. Check your CI/CD pipeline logs and local developer environments to see if versions of LiteLLM were installed or updated during the specific 40-minute window identified by researchers.
Follow these steps to confirm exposure:
- Review your internal package management logs to identify the exact version and timestamp of LiteLLM installations.
- Cross-reference these timestamps against the 40-minute window identified by the security researchers.
- Audit the access logs of any cloud services (AWS, Google Cloud, Azure) associated with the environment variables present on the compromised machines.
- Search for unauthorized API calls or unusual login patterns that occurred shortly after the suspected compromise window.
If you suspect that your organization was exposed to the compromised LiteLLM package, you must treat all credentials stored in those environments as fully compromised. The only effective remediation is to rotate all keys and tokens that were present in the development environment at the time of the incident.
- Revoke and rotate: Immediately invalidate all cloud keys, API tokens, and SSH keys that were stored in environments where LiteLLM was active.
- Update dependencies: Ensure your project is using a verified, secure version of LiteLLM and remove any cached versions of the compromised files.
- Implement secrets management: Move away from storing secrets in environment variables. Use a dedicated tool like HashiCorp Vault, AWS Secrets Manager, or Google Secret Manager to inject credentials at runtime.
- Monitor for persistence: Review your system logs for signs of unauthorized access, such as new user accounts, unexpected firewall changes, or unauthorized database exports.
Preventing future supply-chain attacks requires a "zero-trust" approach to the software dependencies you import into your projects. You cannot assume that a package downloaded from a public repository like PyPI or npm is safe, even if it is a popular and widely used tool.
Use dependency pinning to lock your software to specific, verified versions of a library. Additionally, utilize automated vulnerability scanning tools that monitor your dependencies for known security flaws or suspicious activity. By treating third-party code as potentially untrusted, you can limit the damage if a specific package is ever compromised again.
