--- title: LiteLLM Attack Affected 2,500 Companies, 434,000 CI/CD... description: A supply-chain attack that compromised LiteLLM's build pipeline affected more than 2,500 companies and roughly 434,000 CI/CD pipelines, according to CloudSEK.... canonical: https://daily.dev/posts/litellm-attack-affected-2-500-companies-434-000-ci-cd-pipelines-cloudsek-kk2ilz58a twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: LiteLLM Attack Affected 2,500 Companies, 434,000 CI/CD Pipelines: CloudSEK | daily.dev og:description: A supply-chain attack that compromised LiteLLM's build pipeline affected more than 2,500 companies and roughly 434,000 CI/CD pipelines, according to CloudSEK.... og:url: https://daily.dev/posts/litellm-attack-affected-2-500-companies-434-000-ci-cd-pipelines-cloudsek-kk2ilz58a og:image: https://api.daily.dev/og/posts/Kk2ILZ58a.png og:image:alt: LiteLLM Attack Affected 2,500 Companies, 434,000 CI/CD Pipelines: CloudSEK og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # LiteLLM Attack Affected 2,500 Companies, 434,000 CI/CD Pipelines: CloudSEK **[DevOps.com](https://daily.dev/sources/devops)** · 5 min read · 5 upvotes · 0 comments ## Summary A supply-chain attack that compromised LiteLLM's build pipeline affected more than 2,500 companies and roughly 434,000 CI/CD pipelines, according to CloudSEK. The threat group TeamPCP compromised Aqua Security's Trivy scanner and its GitHub Actions in March, which infected LiteLLM's CI pipeline and led to two malicious packages (versions 1.82.7 and 1.82.8) being published to PyPI for about 40 minutes. Malware including CanisterWorm, SandClock, Mini Shai-Hulud, and Miasma harvested cloud credentials, API keys, Kubernetes tokens, and crypto wallet data, exfiltrating them to a typosquatted domain or uploading them to victims' own public GitHub repos. Victims include Nvidia, Intel, Zscaler, AWS, Cisco, Salesforce, ServiceNow, John Deere, Airbus, FedEx, Volkswagen, Bayer, and Deloitte. The FBI separately issued an advisory noting the same threat actors also compromised Checkmarx's KICS and the Telnyx Python SDK, warning organizations to treat stolen credentials as a persistent risk. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How did the LiteLLM supply chain attack happen? Threat group TeamPCP compromised Aqua Security's Trivy open source vulnerability scanner and its associated GitHub Actions in March, and Trivy's compromised state infected LiteLLM's CI pipeline through an un-revoked token. This led LiteLLM to publish releases 1.82.7 and 1.82.8 containing malicious code to PyPI, which stayed live for about 40 minutes before removal, but automated build systems had already propagated it widely. _Teams wiring scanners and AI gateways into CI pipelines can track supply chain incidents like this on daily.dev._ ### How many companies and CI/CD pipelines were affected by the LiteLLM Trivy supply chain attack? More than 2,500 companies and roughly 434,000 CI/CD pipelines were exposed, according to CloudSEK, including Nvidia, Intel, Zscaler, AWS, Cisco, Salesforce, ServiceNow, Airbus, FedEx, Volkswagen, Bayer, and Deloitte. CloudSEK clarified that these numbers reflect exposure to the threat, not confirmed compromise, since the malicious packages briefly reached widely used build pipelines. _Security teams assessing blast radius from AI-tooling breaches can follow developments like this on daily.dev._ ### What malware was used to steal credentials in the TeamPCP LiteLLM attack? TeamPCP deployed CanisterWorm, which harvests cloud access tokens and API keys for AWS, Google Cloud, and Azure, and SandClock, which targets AWS credentials, Kubernetes service account tokens, and cryptocurrency wallet data. They also used Mini Shai-Hulud and Miasma, self-replicating worms targeting npm and PyPI that steal credentials and damage configuration files, with stolen data sometimes uploaded to victims' own public GitHub repos. _Developers hardening CI secrets against info-stealing malware can keep up with incidents like this via daily.dev._ ## Similar posts on daily.dev - [What the LiteLLM Breach Teaches Us About Securing LLM Gateways](https://daily.dev/posts/what-the-litellm-breach-teaches-us-about-securing-llm-gateways-ysbbrmwzu) · Medium · 0 upvotes · 0 comments - [Sophisticated Supply Chain Attack Targeting Trivy Expands to Checkmarx, LiteLLM](https://daily.dev/posts/sophisticated-supply-chain-attack-targeting-trivy-expands-to-checkmarx-litellm-setw9szuc) · DevOps.com · 0 upvotes · 0 comments - [Checkmarx KICS Code Scanner Targeted in Widening Supply Chain Hit](https://daily.dev/posts/checkmarx-kics-code-scanner-targeted-in-widening-supply-chain-hit-fpc0riglf) · Dark Reading · 0 upvotes · 0 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#python](https://daily.dev/tags/python), [#cicd](https://daily.dev/tags/cicd), [#litellm](https://daily.dev/tags/litellm) [View this post on daily.dev](https://daily.dev/posts/litellm-attack-affected-2-500-companies-434-000-ci-cd-pipelines-cloudsek-kk2ilz58a) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"LiteLLM Attack Affected 2,500 Companies, 434,000 CI/CD Pipelines: CloudSEK","url":"https://daily.dev/posts/litellm-attack-affected-2-500-companies-434-000-ci-cd-pipelines-cloudsek-kk2ilz58a","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/litellm-attack-affected-2-500-companies-434-000-ci-cd-pipelines-cloudsek-kk2ilz58a"},"datePublished":"2026-08-12T16:11:46.930Z","dateModified":"2026-09-14T07:42:05.755Z","description":"A supply-chain attack that compromised LiteLLM's build pipeline affected more than 2,500 companies and roughly 434,000 CI/CD pipelines, according to CloudSEK....","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/463eaf44078e9300bd49002de4527796?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/463eaf44078e9300bd49002de4527796?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"DevOps.com","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"DevOps.com","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/db8f2265cff0416c878c6e7e92bb8715","url":"https://daily.dev/sources/devops"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/litellm-attack-affected-2-500-companies-434-000-ci-cd-pipelines-cloudsek-kk2ilz58a","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":5},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cyber,python,cicd,litellm","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"DevOps.com","item":"https://daily.dev/sources/devops"},{"@type":"ListItem","position":3,"name":"LiteLLM Attack Affected 2,500 Companies, 434,000 CI/CD Pipelines: CloudSEK"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/litellm-attack-affected-2-500-companies-434-000-ci-cd-pipelines-cloudsek-kk2ilz58a#faq","mainEntity":[{"@type":"Question","name":"How did the LiteLLM supply chain attack happen?","acceptedAnswer":{"@type":"Answer","text":"Threat group TeamPCP compromised Aqua Security's Trivy open source vulnerability scanner and its associated GitHub Actions in March, and Trivy's compromised state infected LiteLLM's CI pipeline through an un-revoked token. This led LiteLLM to publish releases 1.82.7 and 1.82.8 containing malicious code to PyPI, which stayed live for about 40 minutes before removal, but automated build systems had already propagated it widely. Teams wiring scanners and AI gateways into CI pipelines can track supply chain incidents like this on daily.dev."}},{"@type":"Question","name":"How many companies and CI/CD pipelines were affected by the LiteLLM Trivy supply chain attack?","acceptedAnswer":{"@type":"Answer","text":"More than 2,500 companies and roughly 434,000 CI/CD pipelines were exposed, according to CloudSEK, including Nvidia, Intel, Zscaler, AWS, Cisco, Salesforce, ServiceNow, Airbus, FedEx, Volkswagen, Bayer, and Deloitte. CloudSEK clarified that these numbers reflect exposure to the threat, not confirmed compromise, since the malicious packages briefly reached widely used build pipelines. Security teams assessing blast radius from AI-tooling breaches can follow developments like this on daily.dev."}},{"@type":"Question","name":"What malware was used to steal credentials in the TeamPCP LiteLLM attack?","acceptedAnswer":{"@type":"Answer","text":"TeamPCP deployed CanisterWorm, which harvests cloud access tokens and API keys for AWS, Google Cloud, and Azure, and SandClock, which targets AWS credentials, Kubernetes service account tokens, and cryptocurrency wallet data. They also used Mini Shai-Hulud and Miasma, self-replicating worms targeting npm and PyPI that steal credentials and damage configuration files, with stolen data sometimes uploaded to victims' own public GitHub repos. Developers hardening CI secrets against info-stealing malware can keep up with incidents like this via daily.dev."}}]} ```