LiteLLM Supply-Chain Attack Exposed Credentials at Microsoft, Amazon, Cisco, Samsung and 2,500 Other Organizations

A 40-minute window in March 2026 is why more than 2,500 organizations, including Microsoft, Amazon, Cisco, Samsung and Salesforce, are dealing with a credential exposure problem now. Security firms CloudSEK and Hudson Rock detailed the incident in reports published this week. Attackers compromised LiteLLM, an open-source gateway that lets developers connect to over 100 AI model providers including Anthropic, Google Gemini and AWS Bedrock. Two malicious versions of the package, 1.82.7 and 1.82.8, sat on the Python Package Index for about 40 minutes before being pulled. That was enough time to do damage at scale. How it happened According to CloudSEK, the LiteLLM compromise wasn't a direct attack. It was the tail end of a longer chain. A threat group called TeamPCP first compromised Aqua Security's Trivy, a widely used open-source vulnerability scanner, along with its GitHub Actions integration. That let attackers reach into LiteLLM's build pipeline through a single credential that hadn't been revoked. "Trivy, then the build system, then the LiteLLM release: one un-revoked token, three tools deep," CloudSEK researchers wrote, according to devops.com. "That chain is what turns a single credential leak into ecosystem-wide exposure." The malicious code accessed memory on infected machines, scraped credentials, and shipped them out through attacker-controlled channels. CloudSEK told cxtoday.com that in some cases, when data couldn't be exfiltrated externally, the malware created a public GitHub repository inside the victim's own account and uploaded stolen data there as a release asset. Some organizations were unknowingly leaking their own secrets in public view. The scale Hudson Rock said it uncovered the exposure after analyzing a 195-terabyte file, though neither firm identified where that file came from. CloudSEK put the number of affected CI/CD pipelines, the automated systems that build, test and deploy code, at roughly 434,000. The haul includes cloud keys for AWS, Google Cloud and Azure, SSH keys, Kubernetes tokens, package-publishing credentials, environment variables and AI provider API keys, according to both firms. CloudSEK's high-confidence organization list, cited by cxtoday.com, includes NVIDIA, AWS, Samsung, Salesforce, Cisco, ServiceNow, Siemens, S&P Global, Deloitte, Vodafone, BT, Zscaler and X. CloudSEK was careful to note that a high-confidence match doesn't prove an organization was actually breached or that stolen credentials were used. It means there's a strong link to the exposure that requires further private investigation. Not every apparent hit was straightforward. Ars Technica reported that an email address tied to the domain @siriusxm.com in the leaked data didn't actually point to a breach at the satellite radio company, but rather at AdsWizz, a SiriusXM subsidiary. That's a reasonable caution for anyone reading raw exposure lists: a domain match isn't automatically proof a parent company was hit. Who's behind it, and why it's not over TeamPCP, described by Ars Technica as a "ramshackle but extremely capable gang largely made up of teenagers," claimed responsibility, and researchers say the evidence backs that up. Independent researcher Kevin Beaumont said he confirmed the leaked data is legitimate across multiple victim organizations. "It's a massive supply chain breach due to poor AI security, not because AI is the threat, but teens can run circles around orgs obsessed with rushing out AI and poor DevOps security," Beaumont said. The FBI issued a FLASH advisory in July 2026 (FLASH-20260702-01) warning that TeamPCP's harvested credentials could be weaponized well after the initial breach. The bureau's advisory also names two other compromised tools in the same campaign: KICS, an open-source code analysis tool from Checkmarx, and the Telnyx Python SDK. "By weaponizing these supply chain entry points, the threat actors were able to introduce malicious code into victim environments at scale," the FBI wrote, according to devops.com. CloudSEK's own warning is blunt: pulling the malicious package doesn't fix anything. "A package can disappear in minutes while copied credentials remain usable for weeks or months unless they are rotated and downstream activity is investigated," the firm said. Separately, Microsoft's threat intelligence team documented a related but distinct campaign it calls "ChainDrop," a self-propagating npm worm that hit more than 400 JavaScript packages, including widely used ones like keyv, flat-cache and cache-manager. That malware automatically republishes itself into new packages once it steals an npm publishing token, creating a chain reaction across the open-source ecosystem. Microsoft is advising any organization that installed an affected package to treat the machine that ran it as compromised, rotate all accessible credentials, and rebuild from trusted sources. Both incidents point to the same underlying problem: modern software runs on thousands of open-source dependencies with automated build pipelines, and a single unrevoked token or unreviewed package update can cascade into thousands of victims within minutes. CloudSEK published its list of affected organizations and pipelines specifically so companies can check whether they're exposed and start rotating credentials. The firm noted that "the threat is still live." Whether the named companies, including Microsoft, Amazon, Cisco and Samsung, have since confirmed actual unauthorized access using the exposed credentials remains an open question none of the four sources answer.