Your AI Tools Are a Supply Chain. And Someone Just Poisoned It.
Two malicious software packages sat on the internet for 40 minutes in March. Today, 2,500 organizations — including NVIDIA, AWS, Cisco, and Salesforce — are rotating credentials. Here's what every business leader needs to understand.
Forty minutes.
That's how long two malicious software packages were publicly available on the internet before security teams caught them in March 2026. Forty minutes — roughly the length of a lunch break.
By the time they were removed, the damage was already done. This week, threat intelligence firm CloudSEK confirmed that those 40 minutes exposed more than 2,500 organizations and 434,000 software build pipelines to potential credential theft. The affected list reads like a Fortune 500 directory: NVIDIA, Amazon Web Services, Cisco, Salesforce, Siemens, FedEx, Volkswagen, Deloitte, and dozens more.
This is the LiteLLM supply chain attack. And if your organization uses AI tools, builds software, or relies on cloud infrastructure — you need to understand what happened.
What Is LiteLLM, and Why Does It Matter?
LiteLLM is a popular open-source Python library used to manage connections to AI models — think of it as a universal remote control for AI services like OpenAI, Anthropic, Google Gemini, and others. Tens of thousands of development teams use it to build AI-powered applications and automate workflows.
It's exactly the kind of tool that sits quietly in the background of modern software — unnoticed, trusted, and deeply integrated.
Which makes it a perfect target.
How the Attack Worked: Three Tools Deep
The attackers didn't go after LiteLLM directly. They went after the tool that builds LiteLLM.
Here's the chain:
1. Step one — compromise Trivy. Trivy is an open-source security scanner made by Aqua Security, widely used to check software components for known vulnerabilities. Attackers obtained a leaked automation token that had been rotated but never fully revoked. That gap gave them a 20-day window to push malicious code into Trivy's published releases.
2. Step two — infect LiteLLM's build pipeline. LiteLLM's automated build system used Trivy — and didn't pin it to a verified, locked version. When the poisoned Trivy ran inside LiteLLM's build pipeline, it injected credential-stealing code into the output.
3. Step three — publish malicious packages. The result: two compromised LiteLLM releases (versions 1.82.7 and 1.82.8) were automatically published to PyPI, the central repository where developers download Python software packages. They sat there for 40 minutes before being quarantined.
As CloudSEK put it: "One unrevoked token, three tools deep. That chain is what turns a single credential leak into ecosystem-wide exposure."
What Got Stolen
The malicious packages contained a payload called SANDCLOCK — a credential harvester designed to run automatically when Python starts, regardless of whether an application imports LiteLLM. On developer workstations and CI/CD build runners, it swept up:
- Cloud credentials: AWS, GCP, and Azure keys - SSH keys and repository tokens - Kubernetes secrets and service account tokens - Package publishing credentials - Environment variables and application secrets - AI provider API keys
For the organizations in CloudSEK's exposure dataset, every secret accessible to any system that installed those packages should be treated as potentially compromised — even if no active theft has been confirmed.
The FBI issued a FLASH advisory in July 2026 warning that actors linked to this campaign (tracked as TeamPCP, also known as UNC6780) are likely to weaponize harvested credentials long after the original intrusion. The stolen keys don't expire the moment they're discovered.
The Scope Tells a Bigger Story
Before you think "this is a software developer problem," consider what those 434,000 CI/CD pipelines actually are.
CI/CD pipelines — continuous integration and continuous deployment systems — are the automated factories that build and ship software inside companies. They run with broad system privileges. They have access to cloud environments, source code repositories, deployment credentials, and production systems.
When a credential-stealing payload runs inside a CI/CD pipeline, it isn't just grabbing one developer's password. It's potentially grabbing the master keys to an organization's cloud infrastructure.
Checkmarx confirmed unauthorized access to its GitHub repositories. Mercor confirmed it was affected. CERT-EU assessed with high confidence that a European Commission AWS account was compromised, with approximately 91.7 GB of data exfiltrated.
This is not a developer story. It's an organizational risk story.
Three Questions Every Business Leader Should Ask Right Now
1. Do you know what software tools are inside your build pipelines?
Most organizations have detailed inventories of their production systems. Far fewer have visibility into what's running inside their CI/CD infrastructure. If your team builds software — even internal tools — you need to know what third-party components are inside that process and whether any were updated in March 2026.
2. Have you rotated credentials that CI/CD pipelines could have touched?
If any system in your environment installed LiteLLM 1.82.7 or 1.82.8 between March 19 and March 24, 2026, the guidance is unambiguous: rotate every credential accessible to that process. Cloud keys, repository tokens, SSH keys — all of them. Not just the LiteLLM-specific credentials. Everything the pipeline could reach.
The FBI has explicitly warned that these credentials may be used in future attacks. Rotation is not optional.
3. Does your vendor contract require breach notification for supply chain events?
Many of the 2,500 organizations in CloudSEK's dataset had no direct relationship with LiteLLM. They were exposed through a dependency they didn't know they had. Does your vendor security program account for this kind of indirect exposure? Do your software vendors notify you when their build pipelines are compromised — even before your data is confirmed stolen?
If not, that's a contract and vendor management gap worth closing.
The Pattern That Should Concern You
This is the third major software supply chain attack in recent months. In August 2026, we saw ChainDrop — a self-propagating worm that hit 400+ npm packages and 500 million weekly downloads. In August 2026, we saw the JetBrains TeamCity zero-day actively exploited against CI/CD infrastructure. Now LiteLLM.
The pattern is clear: attackers are no longer just targeting your systems. They're targeting the tools that build and manage your systems. The trusted components that run with elevated privileges inside your automated processes.
A single unrevoked token. Three tools deep. Forty minutes on the internet.
The blast radius: global.
What TrustPoint Cyber Recommends
If you're uncertain about your exposure, start here:
- Audit your software bill of materials (SBOM) for LiteLLM dependencies, including transitive ones - Check build pipeline logs for any activity on March 24, 2026 between 10:39 UTC and 16:00 UTC - Rotate all cloud credentials, SSH keys, and repository tokens accessible to affected pipelines - Pin all CI/CD dependencies to verified, hash-locked versions — not floating version tags - Require your software vendors to notify you of supply chain compromise events, not just confirmed data breaches
Supply chain security isn't a developer problem. It's a leadership problem. And the organizations that get ahead of it are the ones that treat their build pipelines with the same rigor they apply to their production systems.
If you're not sure where to start, we can help you build that visibility.
Ready to strengthen your security?
TrustPoint Cyber delivers Zero Trust architecture, incident response, managed security, and vCISO services — built for your business.