LiteLLM Supply Chain Attack Hit 2,500 Orgs Through Malicious PyPI Packages
What happened
CloudSEK published research documenting a confirmed supply chain attack in which two malicious versions of LiteLLM were uploaded to PyPI, silently exfiltrating AI provider API keys, cloud credentials, SSH keys, and runtime secrets from more than 2,500 organizations globally. The attack originated in a compromise of Aqua Security's Trivy container scanner, which cascaded downstream into LiteLLM, a library widely used by enterprises to proxy and manage requests across multiple AI provider APIs including OpenAI, Anthropic, and others. The malicious packages were live for approximately 40 minutes, a window short enough to evade many monitoring controls but sufficient to affect an estimated 434,000 CI/CD pipelines. This incident follows a pattern of AI infrastructure being exploited as a high-value entry point, consistent with earlier findings on PyPI credential exfiltration linked to AI tooling and the 89% surge in AI-enabled attacks identified across enterprise environments. CloudSEK's analysis frames AI infrastructure as uniquely attractive to attackers because it sits at the intersection of identity, data, compute, and autonomous action, making compromised libraries far more damaging than equivalent attacks on conventional software dependencies.
Why it matters
- ·Most enterprise third-party AI risk programs focus on AI model providers and overlook the open-source library layer that mediates API access. A malicious or compromised package like LiteLLM can silently collect every AI provider credential and cloud secret passing through it, bypassing controls at the provider level entirely.
- ·Exfiltrated AI API keys represent compounding risk: they grant access to AI systems, cloud environments, and potentially regulated data pipelines simultaneously. Organizations subject to frameworks such as the EU Digital Operational Resilience Act or sector-specific cybersecurity obligations face reporting and remediation obligations that may be triggered by this class of credential exposure.
- ·The 40-minute attack window is shorter than most automated pipeline integrity checks and human review cycles, exposing a timing gap in CI/CD security controls. Organizations relying on periodic dependency scans rather than real-time integrity verification of AI library packages are structurally vulnerable to this attack pattern.
Governance controls affected
What to do now
- ☐Audit all PyPI and open-source dependencies used to access AI provider APIs, specifically LiteLLM and any wrapper libraries, and verify installed versions against known-good checksums.
- ☐Rotate all AI provider API keys, cloud credentials, and SSH keys that were potentially exposed through CI/CD pipelines running LiteLLM during the incident window; treat any key that passed through the library as compromised.
- ☐Review your open-source AI dependency intake policy to require pinned version hashes and cryptographic verification for AI-adjacent libraries before they are permitted in production pipelines.
- ☐Map which CI/CD pipelines have access to AI provider credentials and apply least-privilege controls so that no pipeline holds credentials beyond its minimum required scope.
- ☐Activate your AI incident response playbook to assess whether any exfiltrated credentials have been used post-incident, and determine whether regulatory disclosure obligations are triggered under applicable frameworks.
What to watch next
Regulatory bodies are increasingly treating AI infrastructure compromise as falling within existing cybersecurity incident reporting obligations, and enforcement interpretations under frameworks such as the EU Digital Operational Resilience Act and the EU Cyber Resilience Act are likely to extend to open-source AI dependencies as component software. CloudSEK's finding that AI infrastructure is now a primary attack target aligns with a pattern of escalating supply chain incidents; compliance teams should monitor whether sector regulators in financial services, healthcare, and critical infrastructure issue specific guidance on AI library dependency governance. Organizations should also watch for updated guidance from CISA and equivalent national cybersecurity agencies on software bill of materials requirements for AI tooling, which would impose new inventory and verification obligations on teams currently managing AI dependencies informally.
Stay ahead of stories like this
Get every Global AI governance development like this one, plus the rest of the week's developments. Every Thursday.