A Stolen Token, Three Tools Deep: LiteLLM's Build Pipeline Reached 434,000 CI/CD Pipelines

A supply-chain compromise of LiteLLM, the gateway developers use to call more than 100 large language model providers including Anthropic, Google's Gemini and AWS Bedrock, exposed more than 2,500 companies and roughly 434,000 CI/CD pipelines, according to threat researchers at CloudSEK ^[1][2][3]. LiteLLM itself was never directly attacked: its CI pipeline installed a compromised build of Aqua Security's Trivy scanner, and the resulting releases 1.82.7 and 1.82.8 carried malicious code to the Python Package Index ^[4][5][6].

CloudSEK's own summary of the path is the most useful sentence in the report: "Trivy, then the build system, then the LiteLLM release: one un-revoked token, three tools deep," the researchers wrote, adding that "that chain is what turns a single credential leak into ecosystem-wide exposure" ^[7]. The group behind it, TeamPCP, had compromised Trivy and its associated GitHub Actions earlier in March ^[5][8].

The two malicious LiteLLM packages were on PyPI for about 40 minutes ^[9]. Against the reported totals, that works out to roughly 10,850 exposed pipelines per minute of availability, and about 174 affected pipelines per affected company ^[10][11]. Those are arithmetic averages, not infection counts, but they describe the shape of the problem: automated build systems compress time, and once a malicious artifact reaches a registry it propagates through scheduled jobs, dependency resolvers and developer laptops ^[12]. CloudSEK's position is that removal did not end the exposure, which is why it published lists of compromised companies and affected pipelines ^[13]. The researchers said the "threat is still live" and that knowing you were impacted lets an organization rotate credentials and close the exposure ^[14].

The FBI issued an advisory in July naming the same entry points plus two more: KICS, the open source code analysis tool from Checkmarx, and the Telnyx Python SDK ^[15]. The bureau's framing is that these tools are commonly integrated into enterprise CI/CD pipelines, cloud infrastructure and security workflows, and that weaponizing them introduced malicious code into victim environments at scale ^[16]. It also said TeamPCP has collaborated with other groups and run extortion campaigns that publish victim names on leak sites, and urged organizations to treat exfiltrated data and credentials as a persistent risk ^[17].

What was being taken matches the location. CanisterWorm, one of the distributed payloads, harvests cloud access tokens, credentials and API keys for AWS, Google Cloud Platform and Microsoft Azure; a second stealer, SandClock, targets AWS credentials ^[18][19]. A model gateway is where provider keys, cloud roles and internal service calls converge, which makes it a high-yield place to land. CloudSEK argues that gateways, agent runtimes, MCP servers and vector stores are becoming junctions where compromising one system exposes identities, credentials and data across an organization ^[20].

The operator consequence is unglamorous. The AI gateway in your stack is a Python package with a build pipeline and transitive scanners, and it deserves the same treatment as any other dependency: pinned versions, hash verification, an inventory of which pipelines pull it, and short-lived tokens in the CI that publishes it.

Worth watching: whether the published victim lists prompt credential rotation at named organizations, and whether the next incident in this campaign starts in a security tool again rather than in the AI layer it reaches.