Executive Summary
In March 2026, versions 1.82.7 and 1.82.8 of LiteLLM, an open-source AI gateway, were compromised and published on PyPI. These versions contained credential-stealing code capable of harvesting sensitive information such as cloud keys, SSH keys, Kubernetes tokens, and database passwords. The malicious packages were available for approximately 40 minutes before being quarantined. Subsequent analysis by CloudSEK revealed that the attackers had exfiltrated data from approximately 2,500 organizations, including major corporations like NVIDIA, Cisco, Deloitte, Volkswagen, FedEx, Siemens, and X Corp.
This incident underscores the escalating threat of supply chain attacks targeting widely used open-source components. Organizations are urged to implement stringent security measures, including regular audits of third-party dependencies, to mitigate the risk of similar breaches.
Why This Matters Now
The LiteLLM compromise highlights the critical need for organizations to secure their software supply chains, as attackers increasingly exploit trusted open-source components to infiltrate systems and exfiltrate sensitive data.
Attack Path Analysis
Attackers compromised the LiteLLM package on PyPI, embedding credential-stealing code that harvested sensitive information from systems upon installation. The malicious code exfiltrated harvested credentials to an attacker-controlled domain, potentially granting unauthorized access to numerous organizations. This supply chain attack underscores the critical need for robust security measures throughout the software development lifecycle.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
Attackers injected malicious code into LiteLLM versions 1.82.7 and 1.82.8 on PyPI, leading to the installation of compromised packages by unsuspecting users.
Related CVEs
CVE-2026-33634
CVSS 8.8Malicious code was embedded in Trivy v0.69.4, compromising multiple components and leading to potential credential theft.
Affected Products:
aquasecurity trivy – = 0.69.4
aquasecurity trivy-action – 0.0.1 – 0.34.2
aquasecurity setup-trivy – 0.2.0 – 0.2.6
BerriAI LiteLLM – 1.82.7 – 1.82.8
Exploit Status:
exploited in the wild
MITRE ATT&CK® Techniques
Supply Chain Compromise: Compromise Software Dependencies and Development Tools
Unsecured Credentials: Credentials in Files
Application Layer Protocol: Web Protocols
Obfuscated Files or Information
Archive Collected Data: Archive via Utility
Exfiltration Over C2 Channel
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Ensure the integrity of software and scripts
Control ID: 6.3.2
NYDFS 23 NYCRR 500 – Encryption of Nonpublic Information
Control ID: 500.15
DORA – ICT Risk Management Framework
Control ID: Article 6
CISA ZTMM 2.0 – Identity and Access Management
Control ID: 3.1
NIS2 Directive – Supply Chain Security
Control ID: Article 21
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Computer Software/Engineering
Supply chain attacks targeting AI gateways and CI/CD pipelines expose software development environments to credential theft and malicious code injection.
Information Technology/IT
Compromised LiteLLM releases and Trivy scanner vulnerabilities threaten IT infrastructure security through stolen cloud credentials and Kubernetes tokens.
Financial Services
Exfiltrated database passwords and API keys from supply chain compromise pose severe risks to financial data protection and regulatory compliance.
Government Administration
European Commission breach confirms government cloud environments vulnerable to supply chain attacks targeting security scanning tools and AI frameworks.
Sources
- Malicious LiteLLM Releases Tied to Trivy Hack May Have Exposed 2,100+ Organizationshttps://thehackernews.com/2026/08/malicious-litellm-releases-tied-to.htmlVerified
- NVD - CVE-2026-33634https://nvd.nist.gov/vuln/detail/CVE-2026-33634Verified
- Trivy Supply Chain Attack: What You Need to Knowhttps://www.aquasec.com/blog/trivy-supply-chain-attack-what-you-need-to-know/Verified
- Security Update March 2026https://docs.litellm.ai/blog/security-update-march-2026Verified
- 2,500+ Companies and 434,000 CI/CD Pipelines Exposed in the Largest AI Supply Chain Breach of 2026https://www.cloudsek.com/blog/ai-supply-chain-breach-2500-companies-434000-cicd-pipelinesVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF is pertinent to this incident as it would likely limit the attacker's ability to move laterally and exfiltrate data by enforcing strict segmentation and controlled egress policies.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: The CNSF would likely limit the reach of the malicious code by enforcing strict workload isolation, reducing the potential for the compromised package to affect other systems.
Control: Zero Trust Segmentation
Mitigation: Zero Trust Segmentation would likely constrain the malicious code's access, limiting its ability to reach sensitive resources beyond its immediate environment.
Control: East-West Traffic Security
Mitigation: East-West Traffic Security would likely limit the attacker's ability to move laterally by enforcing strict controls on internal traffic flows.
Control: Multicloud Visibility & Control
Mitigation: Multicloud Visibility & Control would likely detect and limit unauthorized outbound communications, reducing the effectiveness of command and control channels.
Control: Egress Security & Policy Enforcement
Mitigation: Egress Security & Policy Enforcement would likely limit unauthorized data exfiltration by enforcing strict outbound traffic policies.
The CNSF would likely reduce the overall impact by containing the attacker's activities and limiting the scope of compromised credentials.
Impact at a Glance
Affected Business Functions
- Software Development
- Continuous Integration/Continuous Deployment (CI/CD) Pipelines
- Cloud Infrastructure Management
Estimated downtime: 7 days
Estimated loss: $5,000,000
Potential exposure of cloud keys, SSH keys, Kubernetes tokens, database passwords, and other sensitive credentials from over 2,500 organizations.
Recommended Actions
Key Takeaways & Next Steps
- • Implement Zero Trust Segmentation to restrict lateral movement and limit the impact of compromised credentials.
- • Enforce Egress Security & Policy Enforcement to monitor and control outbound traffic, preventing unauthorized data exfiltration.
- • Utilize Threat Detection & Anomaly Response systems to identify and respond to unusual activities indicative of supply chain attacks.
- • Apply Inline IPS (Suricata) to detect and block malicious payloads during the initial compromise phase.
- • Regularly audit and rotate credentials to minimize the risk associated with compromised secrets.
