LiteLLM poisoning exposed thousands of companies

Threat intelligence firms Hudson Rock and CloudSEK reported widespread exposure tied to malicious LiteLLM releases published to PyPI in March 2026. CloudSEK estimated more than 2,500 potentially exposed organisations and roughly 434,000 CI/CD pipelines, while Hudson Rock said it obtained the attackers’ raw archive and attributed 118,829 CI runner dumps to 2,488 corporate domains.

The incident did not stem from a LiteLLM vulnerability. Attackers linked to TeamPCP reportedly compromised Trivy’s release process through an automation token that had been rotated but not fully revoked, then pushed poisoned scanner code into downstream builds. Backdoored LiteLLM 1.82.7 and 1.82.8 packages stayed live on PyPI for roughly 40 minutes, with 1.82.8 using a malicious .pth startup hook that executed when Python launched.

The SANDCLOCK payload escalated privileges and collected SSH keys, cloud credentials, Kubernetes service account tokens, .env files, CI/CD secrets and LLM API keys. CloudSEK said failed exfiltration attempts sometimes created public GitHub repositories in victims’ own accounts and uploaded stolen data as release assets.

The reported counts remain difficult to reconcile, with Hudson Rock’s 433,909 archive files close to the widely cited 434,000 figure and its attributed runner-dump count much lower. Defenders are advised to treat any credentials accessible to affected runners as exposed, check build history and cached artifacts, hunt for unauthorized .pth files, and review logs from March 24, 2026, onward.