Threat intelligence findings released by CloudSEK indicate that more than 2,500 organizations have been potentially exposed following a supply chain compromise affecting LiteLLM in March 2026. According to the investigation, the security incident impacted approximately 434,000 CI/CD pipelines globally, leaving major technology, finance, and industrial enterprises reviewing their internal access controls and deployment environments.
The research builds on a victim dataset compiled by CloudSEK analysts examining a malicious campaign orchestrated by a threat cluster tracked as TeamPCP. High-confidence matches identified within the data span prominent multinational entities, including NVIDIA, Samsung Electronics, Cisco Systems, Siemens, S&P Global, ServiceNow, Deloitte, Vodafone, X Corp, Zscaler, FedEx, Volkswagen, Thales, and the London Stock Exchange Group. Industry experts emphasize that high-confidence labels reflect the strength of evidentiary links to corporate domains, credentials, or repositories, rather than definitive proof of a successful network intrusion or unauthorized data extraction.
The malicious operation commenced on March 24, 2026, when malicious iterations of LiteLLM versions 1.82.7 and 1.82.8 were uploaded to the Python Package Index (PyPI). While the compromised packages remained active for roughly 40 minutes before being removed, that window proved sufficient for automated software supply chain mechanisms. Because CI/CD pipelines typically retrieve and install dependencies automatically with elevated administrative privileges, the poisoned package moved through corporate build systems at machine speed without human code review.
The Upstream Chain: How a Filtered Token Compromised 434,000 Pipelines
LiteLLM itself was not originally breached from within. Instead, CloudSEK documented an upstream vector involving Trivy, a widely deployed open-source vulnerability scanner. An automation token associated with the scanner had previously been rotated but failed to undergo complete revocation. This oversight created a 20-day window during which attackers forcefully pushed malicious code over the published version tags of the scanner.
Because the LiteLLM build pipeline pulled Trivy without strict pinning or package manager blocks, the contaminated scanner flowed directly into the application’s compilation process. The resulting poisoned build then generated and published the malicious PyPI releases. This multi-stage compromise demonstrated how a single unrevoked token positioned three layers away from the final package can weaponize downstream developer workflows.
The payload architecture was engineered to maximize impact within short timeframes. Version 1.82.8 injected a malicious .pth file into the local Python environment. These files execute automatically whenever the Python interpreter initializes, irrespective of whether the application imports LiteLLM, thereby bypassing conventional installation-time script protections. Once running on compromised build runners, a credential harvesting tool designated by the FBI as SANDCLOCK elevated permissions to root level. The utility harvested SSH keys, cloud provider access tokens for Amazon Web Services, Google Cloud, and Azure, Kubernetes service account tokens, local environment files, and CI/CD secrets by scraping process memory. Cloud credentials were drawn directly from instance metadata services, leveraging existing runner privileges rather than exploiting software vulnerabilities. For artificial intelligence development environments specifically, the exfiltration sweep captured Large Language Model API keys and gateway configurations, exposing an organization’s entire AI stack.
Data Exfiltration and Persistent Exposure Risks
Extracted data was encrypted using a hardcoded key and exfiltrated to a typosquatted domain. In instances where external network exfiltration failed, the malware generated a public repository inside the victim organization’s own GitHub account, uploading the gathered material as a release asset. This mechanism resulted in several targeted entities inadvertently publishing their internal secrets publicly.
Removing the malicious packages from PyPI did not remediate the underlying risk. Any secret exposed while the poisoned packages were active remained valid until explicitly revoked or rotated by administrators. The Federal Bureau of Investigation addressed these persistence risks in a Flash advisory issued on July 2, 2026, concerning TeamPCP activities. The federal warning cautioned that organizations impacted by the campaign must treat compromised credentials as active threats because affiliated actors frequently leverage harvested data long after initial access closes.
The FBI advisory confirmed that TeamPCP targeted multiple critical tools embedded within enterprise pipelines and cloud infrastructure, including Trivy, Checkmarx KICS, LiteLLM, and the Telnyx Python SDK. Threat actors frequently paired these supply chain intrusions with extortion tactics, publishing victim names on public leak sites and threatening further disclosures.
Mitigation Strategies and Recommended Remediation
Federal law enforcement guidelines recommend specific defensive measures to counter the techniques exploited in the LiteLLM incident:
- Pin GitHub Actions to verified commit hashes rather than relying on floating version tags.
- Rotate every CI/CD secret and publishing token that was accessible during the active exposure window.
- Enforce strict least-privilege access controls across all service accounts and container registry tokens.
- Audit GitHub organization repositories to detect unauthorized projects carrying names such as tpcp-docs or docs-tpcp, which are automatically generated by the malware using stolen credentials.
CloudSEK has launched a public exposure verification portal allowing organizations to check if their infrastructure appears within the research dataset. Security analysts advise treating every credential readable by affected processes as potentially compromised until independently validated. Incident responders should review multi-system access logs across cloud environments, source code repositories, and container clusters, executing broad credential rotation rather than limiting updates to LiteLLM or model provider keys.
Organizations that operated the affected packages in March face an urgent remediation timeline as external threat actors continue exploiting unrotated tokens. Industry participants seeking additional guidance can review technical advisories published by cybersecurity authorities and monitor official disclosures for further updates.
Related reading