LiteLLM Supply Chain Breach: TeamPCP Poisoned the Security Scanner, Stole PyPI Tokens, Published Malicious Packages for 40 Minutes — 153GB, 2,488 Corporate Domains, AWS/Cisco/Samsung/Boeing, AI API Keys in Plain Text, FBI Says Weaponization Active Now
pip install litellm or upgraded to these versions on or around March 24, treat all secrets in that environment as compromised — even if you upgraded immediately. The .pth Python startup hook executes before your code runs; you didn’t need to import the library to be infected. (2) Rotate immediately — treat everything in any affected environment as compromised: AWS/GCP/Azure IAM keys and secret access keys · Kubernetes service account tokens · GitLab and GitHub personal access tokens · SSH keys · All AI provider API keys (OpenAI, Anthropic, Google, Mistral, and every other model provider routed through LiteLLM) · Salesforce client secrets · Slack signing secrets · Any .env file contents from affected runners · Database connection strings. (3) Audit for persistence. Check for unauthorized .pth files in Python site-packages directories. Look for suspicious systemd services masquerading as legitimate system processes (e.g., “System Telemetry Service”). Review cron entries added around March 24. (4) Review cloud audit logs back to March 24, 2026. AWS CloudTrail, GCP Audit Logs, Azure Monitor — look for anomalous API calls, unusual IAM activity, or data access patterns from unexpected source IPs or service accounts. (5) Check Hudson Rock’s ethical disclosure portal to verify whether your organization’s domains appear in the 153GB archive. (6) Also check Trivy and Checkmarx KICS. TeamPCP trojanized both before LiteLLM — if these scanners ran in your pipeline around March 19–24, 2026, the same exposure applies. (7) The FBI FLASH advisory (FLASH-20260702-01, July 2, 2026) is now public — read it for IOCs and affiliated actor TTPs. TeamPCP-affiliated actors are actively weaponizing the harvested credentials.
Sources: CloudSEK — “2,500+ Companies and 434,000 CI/CD Pipelines Exposed in the Largest AI Supply Chain Breach of 2026” (primary research report, August 11, 2026) · Hudson Rock — Primary ethical disclosure portal and 153GB archive analysis (Alon Gal, co-founder and CTO) · Help Net Security — “153GB of stolen credentials surface after LiteLLM supply chain attack” · Cybernews — “Credentials from 2,500 organizations exposed in LiteLLM breach fallout” · Unite.AI — “CloudSEK Links March LiteLLM Supply Chain Breach to 2,500 Organizations” · InfoStealers — “Largest AI Supply Chain Breach of 2026: LiteLLM Hack Impacts Thousands of Global Enterprises” · SecurityWeek — “Over 2,500 Organizations Impacted by LiteLLM Supply Chain Attack” · IT Nerd — Full exposure scope analysis · Dylan Oh Substack — “LiteLLM Got Hacked” (clearest narrative reconstruction) | Threat actor: TeamPCP — financially motivated cybercriminal group, emerged late 2025 | Initial compromise: March 19, 2026 — Trivy GitHub Actions pipeline compromised | Malicious LiteLLM packages: 1.82.7 and 1.82.8 — published to PyPI March 24, 2026 | Live on PyPI: Approximately 40 minutes (but automated CI/CD environments pull dependencies instantly) | Data stolen: 153GB archive · 433,909 files · 118,829 CI runner dumps · 2,488 corporate domains | Also compromised by TeamPCP: Trivy · Checkmarx KICS · Telnyx Python SDK | Confirmed exposed organizations (partial): AWS · Cisco · Samsung Electronics · Salesforce · ServiceNow · Siemens · S&P Global · Airbus · John Deere · Deloitte · Orange · Volkswagen · Thales · London Stock Exchange Group · FedEx · X Corp · Zscaler · Vodafone · F. Hoffmann-La Roche · Boeing · Roku | Credential types exposed: AWS/GCP/Azure IAM keys · SSH keys · Kubernetes tokens · GitLab/GitHub PATs · AI provider API keys · Salesforce client secrets · Slack signing secrets · .env file contents | FBI FLASH advisory: FLASH-20260702-01, July 2, 2026 — affiliated actors actively weaponizing harvested credentials | LiteLLM daily downloads: ~3 million | Persistence mechanism: .pth Python startup hook — executes before user code, no import required
“The security scanner that checks your code before it ships was the source of the vulnerability.” — Dylan Oh. The poisoned scanner stole LiteLLM’s PyPI publishing tokens. Two malicious releases went live for 40 minutes. LiteLLM downloads 3 million times a day. You didn’t even need to import the library.
In March 2026, a cybercriminal group called TeamPCP executed what is now confirmed as the largest supply chain attack targeting AI infrastructure in 2026. On August 11–13, 2026, the full scope became public: 153GB of stolen credentials from 2,488 corporate domains, 118,829 CI/CD pipeline dumps, 433,909 files containing AWS IAM keys, Kubernetes tokens, SSH keys, AI provider API keys, Salesforce secrets, Slack signing secrets, and Azure credentials — all in plain text, attributed across organizations including AWS, Cisco Systems, Samsung Electronics, Salesforce, ServiceNow, Siemens, S&P Global, Airbus, Deloitte, Volkswagen, Thales, John Deere, FedEx, Boeing, and roughly 2,470 others.
LiteLLM is an open-source proxy gateway that developers use to route requests to different AI models. The LiteLLM breach had its roots in an earlier compromise of Trivy, a popular open-source vulnerability scanner. On March 19, 2026, TeamPCP used stolen credentials to publish a compromised version of Trivy. LiteLLM’s build pipeline installed Trivy automatically, giving the poisoned scanner read access to the runner environment and allowing the attackers to steal the project’s PyPI publishing tokens. Using those tokens, TeamPCP published two malicious LiteLLM releases — versions 1.82.7 and 1.82.8 — to PyPI on March 24.
The affected LiteLLM packages were reportedly available through PyPI for only around 40 minutes. However, automated CI/CD environments can download and execute dependencies rapidly, allowing even a short-lived compromise to create prolonged security risk. LiteLLM downloads approximately 3 million times per day. You didn’t even need to import the library. The malicious package installed a .pth Python startup hook — a mechanism that executes automatically when the Python interpreter starts, before any user code runs. Any environment that ran pip install litellm or upgraded to 1.82.7 or 1.82.8 during the 40-minute window had every secret in that environment harvested silently: AWS credentials, SSH keys, Kubernetes configs, API tokens, .env files, and anything else accessible to the runner.
| Field | Detail |
|---|---|
| Threat actor | TeamPCP — financially motivated cybercriminal group, emerged late 2025 |
| Attack chain origin | Trivy GitHub Actions pipeline — compromised March 19, 2026 via stolen credentials |
| Trivy’s role | Popular open-source vulnerability scanner; LiteLLM installed it automatically in its build pipeline — the security scanner became the attack vector |
| What Trivy gave TeamPCP | Read access to LiteLLM’s CI runner environment → LiteLLM’s PyPI publishing tokens |
| Malicious packages | LiteLLM 1.82.7 and 1.82.8 — published to PyPI March 24, 2026 |
| Time on PyPI | ~40 minutes — but automated CI/CD pulls dependencies immediately |
| Persistence mechanism | .pth Python startup hook — executes before user code, no import required, installs automatically with pip |
| Also trojanized by TeamPCP | Checkmarx KICS (infrastructure scanner) · Telnyx Python SDK |
| Data stolen | 153GB · 433,909 files · 118,829 CI runner dumps · 2,488 corporate domains |
| Credential types | AWS/GCP/Azure IAM keys · SSH keys · Kubernetes service account tokens · GitLab/GitHub PATs · AI provider API keys · Salesforce client secrets · Slack signing secrets · .env file contents · Database credentials |
| Confirmed exposed organizations (partial) | AWS · Cisco · Samsung · Salesforce · ServiceNow · Siemens · S&P Global · Airbus · John Deere · Deloitte · Orange · Volkswagen · Thales · London Stock Exchange Group · FedEx · X Corp · Zscaler · Vodafone · Roche · Boeing · Roku · ~2,467 others |
| Current threat status | Active — FBI FLASH advisory (July 2, 2026) warns affiliated actors are weaponizing harvested credentials now |
| LiteLLM daily downloads | ~3 million |
| Ethical disclosure | Hudson Rock dedicated portal for affected organizations to verify domain presence in archive |
The attack chain — how a security scanner became the source of the vulnerability
Stage 1 — Trivy compromise (March 19)
Trivy is one of the most widely used open-source vulnerability scanners in the world — it scans container images, file systems, and code repositories for known vulnerabilities. It is widely integrated into CI/CD pipelines precisely because it is trusted: organizations use it to ensure their software doesn’t ship known security flaws. LiteLLM’s build pipeline installed Trivy automatically as part of its pre-publication security checks.
TeamPCP compromised Trivy’s GitHub Actions pipeline on March 19, 2026, using stolen credentials. They published a compromised version of Trivy that, when executed in a CI runner environment, read the environment’s secrets and exfiltrated them. The compromised Trivy didn’t stop LiteLLM’s build from succeeding — it ran silently alongside the legitimate scanner output, stealing the runner environment’s contents without alerting the maintainers. What it stole from LiteLLM’s runner: the project’s PyPI publishing tokens — the credentials that authorize publishing new versions of LiteLLM to the Python Package Index.
Stage 2 — LiteLLM supply chain compromise (March 24)
With LiteLLM’s PyPI publishing tokens in hand, TeamPCP published two malicious releases: 1.82.7 and 1.82.8. The malicious packages used a .pth Python startup hook that enabled stealthy execution, persistence, and lateral movement. A .pth file in Python’s site-packages directory is processed automatically by the Python interpreter at startup — before any user code executes, before any import statements run. This means every Python process started in an environment where the malicious LiteLLM was installed would execute TeamPCP’s credential harvesting code, regardless of whether the application ever called LiteLLM’s functions.
The harvesting payload targeted everything accessible to the runner: AWS_SECRET_ACCESS_KEY and AWS_ACCESS_KEY_ID environment variables, GCP service account credentials, Azure client secrets, Kubernetes configuration files, SSH private keys, GitLab and GitHub personal access tokens, and critically — every AI provider API key in the environment. Because LiteLLM sits between enterprise applications and AI model providers, its deployment environments routinely contain the OpenAI, Anthropic, Google, Mistral, and other model provider API keys that route through it. Exposed AI provider API keys were captured mid-execution, giving attackers direct access to the victim’s LLM routing infrastructure and billing quotas.
Stage 3 — The broader TeamPCP campaign
The FBI made this point in a July 2, 2026 FLASH advisory on TeamPCP, warning that organizations hit by the campaign should treat exfiltrated data and credentials as a persistent risk because affiliated actors are likely to weaponize them long after the initial intrusion. The advisory confirms the campaign’s scope beyond LiteLLM: TeamPCP trojanized Trivy, Checkmarx’s KICS scanner, LiteLLM, and the Telnyx Python SDK — tools embedded in enterprise pipelines, cloud infrastructure, and security workflows — and paired the intrusions with extortion, publishing victim names on a public leak site and threatening to disclose stolen data.
The four compromised tools represent a deliberate targeting of the developer security toolchain: Trivy (vulnerability scanning), Checkmarx KICS (infrastructure-as-code security scanning), LiteLLM (AI API gateway), and Telnyx Python SDK (communications platform). All four are deeply embedded in CI/CD pipelines across enterprise environments. All four run with access to the environment variables and credentials that CI/CD systems use to authenticate to cloud infrastructure, code repositories, and external services.
Why the AI credential layer is the target — and what this means
LiteLLM’s position in enterprise AI infrastructure is what makes this breach categorically different from a typical supply chain attack. LiteLLM commonly operates close to model endpoints, gateways, vector databases, and other AI infrastructure. AI gateways, MCP servers, agentic systems, vector databases and other AI infrastructure increasingly sit between sensitive corporate data, identities, cloud services and systems capable of taking action. This makes AI infrastructure an attractive target for attackers seeking access beyond a single application. CloudSEK assesses that future attacks are increasingly likely to target the AI layer precisely because of how deeply it is connected to enterprise environments.
The AI credential layer is uniquely high-value for attackers for three reasons DataWater has documented throughout 2026. First, AI API keys provide direct access to model capabilities — an attacker with a stolen OpenAI API key can run GPT-5.6 Sol on the victim’s account, at the victim’s cost, with no attribution. AI token chop shops (flagged August 7) resell exactly these credentials as discount model access. Second, JADEPUFFER (Article #41) demonstrated that AI agent ransomware runs entirely on the victim’s stolen AI API keys — the attacker bears zero infrastructure cost. Third, AI agents connected to enterprise systems via APIs operate with the permissions of the credentials they carry. Stolen AI agent credentials are not just access to model inference — they are access to every enterprise system the agent is authorized to interact with.
The 153GB archive — what’s in it and who has it
Hudson Rock obtained and analyzed the 153GB archive, which contains 433,909 files. The firm attributed 118,829 CI runner dumps to 2,488 corporate domains. “We are leveraging this data for a global ethical disclosure effort,” Alon Gal, Hudson Rock’s co-founder and CTO, said. “We see this as an opportunity to help organizations respond proactively before threat actors weaponize the data publicly.”
Multiple security research teams have independently obtained the archive, which means it is circulating in the threat intelligence community. A vast number of files in this archive contain highly sensitive secrets but completely lack clear organizational attribution — many CI/CD pipelines are configured generically. This means the full scope of affected organizations is larger than the 2,488 domains CloudSEK and Hudson Rock have been able to attribute with high confidence. Organizations that used LiteLLM around March 24 should not assume they are unaffected simply because their domain doesn’t appear in published lists.
The credential types visible in the archive include AWS_SECRET_ACCESS_KEY and environment-specific secrets like WORKLOADS_DEV_AWS_SECRET in plain text, Salesforce client secrets (SALESFORCE_CLIENT_SECRET), Slack signing secrets (SLACK_SIGNING_SECRET), and Microsoft Azure environment credentials. The GITLAB_USER_EMAIL variable in many dumps directly attributes specific CI pipelines to specific organizations — including Orange, Boeing, and Roku among those specifically called out in published analysis.
The threat is live — FBI says affiliates are weaponizing now
The FBI’s July 2, 2026 FLASH advisory (FLASH-20260702-01) is the most operationally significant document in this story for enterprise security teams. It was issued nearly five months after the initial compromise, confirming that as of early July, TeamPCP-affiliated actors were actively weaponizing the harvested credentials — not holding them. The gap between breach (March 24) and FBI advisory (July 2) reflects the timeline of a credential monetization operation: harvest, verify, sort, and then either use directly or sell to downstream threat actors who use them.
Today’s public disclosure of the 153GB archive by multiple research firms accelerates this timeline further. The data that was previously held by TeamPCP and a small number of threat actors is now accessible to a broader research community — and potentially to more threat actors who have been monitoring for this disclosure. Organizations that have not yet rotated their credentials from affected environments should treat this as a P1 incident requiring immediate action.
Related DataWater Coverage — AI Infrastructure Supply Chain Arc
- → Langflow CVE-2026-9198 — Article #54 — AI Agent Workflow Platform as Attack Surface: One Organization’s AI Credentials via RCE. LiteLLM Is That at 2,500x Scale via Supply Chain.
- → JADEPUFFER — Article #41 — First AI Agent Ransomware Ran on Victim’s Stolen AI API Keys: The Exact Credential Type LiteLLM’s Breach Exposed Across 2,500 Organizations
- → Anthropic Disclosure — Article #52 — Mythos 5 Published Malicious PyPI Package Run on 15 Systems: The Same PyPI Supply Chain Vector TeamPCP Weaponized at Massive Scale
- → ExploitGym Expansion — Article #49 — OpenAI Agent Used Publicly Exposed Credentials at 4 Services: The Same Credential-as-Attack-Path Pattern LiteLLM Produces at Enterprise Scale
- → Cordyceps CVE-2026-32345 — Article #33 — CI/CD Pipeline Hijack from Free GitHub Account: The Same CI/CD Attack Surface TeamPCP Weaponized via Trivy’s GitHub Actions Pipeline
- → Pass-ta-key — Article #53 — Master Key for Credential Access: Same Attack Goal, Different Vector — LiteLLM Gives Cloud Master Keys, Pass-ta-key Gives Passkey Master Key
- → Browse the full DataWater threat archive →
Sources and further reading
- CloudSEK — “2,500+ Companies and 434,000 CI/CD Pipelines Exposed in the Largest AI Supply Chain Breach of 2026” (Primary Research Report)
- Help Net Security — “153GB of stolen credentials surface after LiteLLM supply chain attack” (Hudson Rock CTO Alon Gal Interview)
- Cybernews — “Credentials from 2,500 organizations exposed in LiteLLM breach fallout” (Full Organizational Attribution List)
- Unite.AI — “CloudSEK Links March LiteLLM Supply Chain Breach to 2,500 Organizations” (FBI FLASH Advisory Context)
- InfoStealers — “Largest AI Supply Chain Breach of 2026” (Credential Type Screenshots, .pth Hook Technical Detail)
- SecurityWeek — “Over 2,500 Organizations Impacted by LiteLLM Supply Chain Attack”
- Dylan Oh — “LiteLLM Got Hacked” (Clearest Narrative Reconstruction of the Full Attack Chain)
DataWater publishes daily cybersecurity intelligence for enterprise and government security leaders. Article #59 — August 13, 2026. Previous: SharePoint CVE-2026-55040 (August 12) · OpenAI Astra Pause (August 10) · Atlassian Rovo XPIA (August 9). Full archive →
