Cascading Blast Radius: How the LiteLLM Supply Chain Attack Compromised 2,500+ Organizations and 430,000 CI/CD Pipelines
Executive Summary
In August 2026, investigations by CloudSEK and SecurityWeek revealed one of the most significant AI-centric infrastructure breaches to date. The threat actor group identified as TeamPCP (also tracked as UNC6780) orchestrated a sophisticated, multi-tier cascading supply chain compromise targeting LiteLLM, a critical open-source AI gateway used to route requests across various enterprise AI models.
The scale of the exfiltration is unprecedented in the AI engineering sector. Analysis of the leaked materials identifies a massive archive exceeding 153 GB, containing 433,909 files and 118,829 CI runner dumps. This breach has direct impact on over 2,488 corporate domains and 2,500+ organizations across six major CI/CD platforms (Hudson Rock Analysis, Help Net Security).
Upstream Genesis: The Trivy-to-LiteLLM Cascade
The compromise did not begin with LiteLLM itself but through a strategic upstream infiltration of Aqua Security's vulnerability scanner, Trivy.
The Upstream Infiltration
TeamPCP gained unauthorized access to the aquasecurity/trivy-action repository on GitHub. The root cause was traced to a leaked automation credential that, while rotated by the maintainers, remained unrevoked. This oversight granted the attackers the requisite permissions to publish malicious release tags within the official Trivy action ecosystem (The Hacker News).
The Automated CI Pipeline Infection
As LiteLLM utilized automated GitHub Actions for its build pipelines, it pulled the poisoned Trivy scanner dependency. Because the pipeline lacked strict cryptographic commit or SHA-256 hash pinning, it automatically ingested the malicious release published by the threat actors.
PyPI Token Exfiltration & Package Poisoning
Once the backdoored Trivy action executed within LiteLLM’s CI environment, it harvested LiteLLM’s PyPI publishing credentials stored as repository secrets. Armed with these tokens, TeamPCP pushed malicious versions litellm==1.82.7 and litellm==1.82.8 directly to the Python Package Index (PyPI) on March 24, 2026 (SecurityWeek).
The 40-Minute Window Paradox
Research from SOCRadar and SecurityWeek highlights a critical "Paradox of Exposure." While the poisoned LiteLLM packages were only live on PyPI for approximately 40 minutes before quarantine, the vast majority of victims (over 95%) were already compromised. This is because the upstream Trivy infection wave had been propagating through other pipelines for five days prior to the LiteLLM PyPI poisoning.
Deep-Dive Technical Analysis: The SANDCLOCK Credential Stealer
The primary payload identified in this attack is the SANDCLOCK infostealer, a custom malware designed to harvest secrets from development and production environments.
Execution Hook Mechanics
The malware ensured persistence and automatic execution by leveraging Python .pth (path configuration) files. These files are executed upon Python interpreter startup. Furthermore, hooks were embedded within litellm/proxy/proxy_server.py to trigger the malware during both the initial installation (pip install) and the subsequent execution of the AI gateway server.
Automated Memory & Environment Harvesting
SANDCLOCK performed an exhaustive sweep of the infected environment, targeting:
* Process environment variables.
* CI runner configuration files.
* Local file systems across GitHub Actions, GitLab CI, Jenkins, Bitbucket Pipelines, CircleCI, and Buildkite (GitGuardian Analysis).
Targeted AI & Cloud Assets
The payload specifically prioritized high-value secrets essential for AI operations and cloud infrastructure (StepSecurity Analysis):
Category
Targets
AI API Keys
OpenAI, Anthropic Claude, AWS Bedrock, Google Cloud Vertex AI, Azure OpenAI, Groq, Cohere
Cloud Credentials
AWS Access Keys, GCP Service Accounts, Azure Key Vault Tokens
Access Tokens
GitHub Actions PATs, Slack Webhooks
Infrastructure
Private SSH Keys
C2 Exfiltration Architecture
Captured secrets were staged in local archives, often named 127.0.0.1.txt. These "loot archives" were then transmitted through encrypted exfiltration channels to attacker-controlled command-and-control (C2) infrastructure using automated routines.
Enterprise Blast Radius & Supply Chain Threat Modeling
The AI Gateway as a Single Point of Failure (SPOF)
The LiteLLM breach underscores the risk of centralized AI routing proxies. These gateways act as a "master key" to an organization’s entire generative AI ecosystem, including model fine-tuning data and proprietary prompts. Compromising the gateway effectively grants an adversary control over all downstream AI service integrations.
Transitive Software Ecosystem Risks
The ripple effect of a single unrevoked token in a security tool (Trivy) demonstrates how trust in the software supply chain is inherently transitive. A vulnerability in a security scanner propagated through automated build systems to compromise AI infrastructure at Fortune 500 enterprises and defense contractors.
Secondary Exploitation & Credential Brokering
Intelligence suggests that the exfiltrated 153 GB database is being actively brokered on underground forums and dark web channels, posing a long-term risk of secondary exploitation even after the initial malware is removed.
Comprehensive Mitigation & Hardening Playbook
To defend against the SANDCLOCK malware and similar supply chain threats, organizations must implement the following controls:
1. Immediate Package Remediation: Force an upgrade to LiteLLM v1.82.9 or higher. Critically, engineers must manually inspect environment directories to ensure the removal of cached wheels and any residual .pth persistence artifacts.
2. Comprehensive Secret & API Key Revocation: Assume all secrets exposed in CI runners are compromised. Rotate all LLM provider API keys, cloud IAM tokens, and GitHub PATs immediately.
3. Cryptographic Dependency Pinning: Transition from version-based pinning to hash-based pinning. Use pip install --require-hashes with lockfiles generated by Poetry or Pipenv to ensure the integrity of every dependency.
4. CI/CD Token Scoping & OIDC Migration: Move away from static, long-lived tokens for PyPI and cloud providers. Implement OpenID Connect (OIDC) to leverage ephemeral, short-lived session tokens for publishing.
5. Network Egress Isolation & Build Sandboxing: Configure CI/CD runners with strict egress filtering. Block all outbound traffic except to known, trusted domains (e.g., PyPI, GitHub) to prevent C2 communication during dependency installation.