Overview
- In March, attackers who first compromised the Trivy vulnerability scanner caused two malicious LiteLLM versions to appear on PyPI for about 40 minutes and those packages were later quarantined.
- The compromised LiteLLM releases contained code that scraped environment variables, API keys, SSH keys, cloud credentials and other secrets from infected hosts and sent them to an attacker‑controlled domain.
- Security firms CloudSEK and Hudson Rock published reconstructions that link captured files to more than 2,500 organizations and roughly 434,000 CI/CD events while cautioning those totals are reconstructions of stolen logs and not confirmed victim counts.
- Authorities and ecosystem maintainers have removed the malicious releases from PyPI and issued guidance from the FBI, CISA and PyPA telling teams to rotate CI/CD and cloud credentials, hunt for indicators such as tpcp‑docs repositories, and prefer short‑lived tokens.
- The incident shows how a single leaked token or unpinned dependency can cascade through automated build systems to produce widespread exposure and it signals growing attacker focus on AI control points that link identities, data and compute.