A supply chain attack involving the open-source LiteLLM package has exposed a vast collection of corporate credentials, giving security researchers a look at how much sensitive access can sit inside the tools companies use to build and run AI systems.
The stolen dataset is part of a 153GB archive linked to the March compromise, which researchers say contained cloud credentials, SSH keys, AI provider tokens, and other secrets from thousands of organizations.
The incident began when attackers published malicious versions of LiteLLM, an open-source gateway that helps applications connect to large language models from different providers. The compromised releases, versions 1.82.7 and 1.82.8, were uploaded to PyPI on March 24 after attackers obtained access to credentials used in LiteLLM’s publishing process.
How The Attack Reached LiteLLM
The compromise did not start with LiteLLM itself.
Security researchers traced the attack back to a compromise involving Trivy, an open-source security scanner used in LiteLLM’s CI/CD pipeline. The attackers used access gained through that earlier compromise to obtain credentials that allowed them to publish packages to PyPI. LiteLLM’s maintainers later confirmed that the malicious releases had not gone through their normal GitHub release process.
This distinction matters because it shows how an attacker can move through trusted software relationships rather than breaking directly into a company’s main systems.
Once installed, the malicious LiteLLM packages were designed to collect sensitive information from affected environments. The stolen material included AWS, Google Cloud and Microsoft Azure credentials, SSH keys, Kubernetes credentials, database passwords, CI/CD secrets, environment variables, and AI service API keys.
Version 1.82.8 made the attack particularly serious by adding a malicious `.pth` file. This type of file can execute when Python starts, meaning the malware did not require a developer to explicitly import the affected LiteLLM module.
The Scale Became Clearer Months Later
The original malicious packages were removed after the attack was discovered, but the consequences did not end with their removal.
CloudSEK and Hudson Rock later analyzed stolen data connected to the campaign. Their findings pointed to more than 2,500 organizations and roughly 434,000 CI/CD pipelines being exposed. The dataset included credentials belonging to major technology and enterprise companies, although exposure does not mean every named organization was successfully compromised.
The 153GB archive is significant because it shows what attackers can obtain when malicious code reaches developer environments where companies routinely store credentials for cloud services, software repositories, and AI platforms.
The AI Infrastructure Problem
LiteLLM sits in a layer that can be easy to overlook when companies focus their security efforts on their AI models and applications.
The gateway connects applications to multiple AI providers, which means its surrounding development environments can contain credentials for different parts of an AI stack. The attack showed that compromising an AI infrastructure dependency can therefore expose access well beyond the package itself.
LiteLLM says the affected packages were deleted and that maintainer accounts were rotated after the incident. Its security guidance also recommends rotating credentials that may have been present in environments where the compromised versions were installed.
The bigger lesson from the incident is that as companies build more AI systems on layers of open-source packages, CI/CD tools, and cloud services, those supporting layers can hold access to some of the most valuable parts of the business. Security teams will have to watch those layers just as closely as the AI applications they ultimately support.
