Terabytes of Credentials Leaked: A Supply-Chain Attack via LiteLLM

Researchers from CloudSEK and Hudson Rock have reported one of the largest software supply-chain attacks to date. The compromised target was LiteLLM — an open-source tool that streamlines development with AI. Credentials from more than 2,500 organizations were affected, including Nvidia, AWS, Samsung, Cisco, Salesforce, Siemens, Airbus, FedEx, Volkswagen, Deloitte and X Corp.

Forty minutes — and terabytes of secrets

The malicious code was contained in LiteLLM versions 1.82.7 and 1.82.8, hosted in the official PyPI repository. In March, the window of active attack lasted only about forty minutes, but that was enough: the infected packages read the contents of machines' memory and exfiltrated it through a channel controlled by the attackers. Hudson Rock discovered the leak while analyzing a file measuring 195 TB.

The dump contained cloud keys, repository tokens, SSH keys, Kubernetes secrets, package-publishing credentials, environment variables and AI-provider keys — secrets for Salesforce, Slack, Microsoft Azure and other platforms. Both companies estimate that the data of roughly 434,000 CI/CD pipelines was compromised.

A chain within a chain

The attack on LiteLLM itself was the consequence of an earlier compromise: the widely used vulnerability scanner Trivy was infected, as were KICS and the Telnyx Python SDK. Responsibility was claimed by the group TeamPCP, which, according to the researchers, consists mostly of teenagers; their involvement has largely been confirmed.

Independent specialist Kevin Beaumont verified the authenticity of the data using the example of several affected organizations. In his view, the scale of the damage stems not from AI itself being a threat, but from weak DevOps security amid companies' rush to adopt AI: “teenagers can outplay organizations obsessed with getting AI out the door as fast as possible.”

The Trivy developers' blunder is telling too: they rotated the automation token but failed to revoke the old one for 20 days, which gave the attackers nearly three weeks to slip malicious code into third-party builds.

The response leaves much to be desired

Both companies are urging every organization that used the infected versions to undertake an “aggressive revocation of credentials”: treat any accessible secret as compromised, invalidate cloud keys, Kubernetes service-account tokens and personal GitLab/GitHub tokens, and review logging and outbound-traffic filtering.

Some of the affected parties, however, took the warning less than seriously. One of the largest American tech companies told Beaumont that it had already rotated all its keys and there was no cause for concern. The researcher, making use of a provision in their responsible-disclosure policy, tested the credentials — nearly all of them still worked.

According to Hudson Rock co-founder Alon Gal, a single breach further up the chain now simultaneously affects thousands of companies, and this scale ushers the security industry into an entirely new reality.

Source: Ars Technica