LiteLLM supply-chain poison hits AI infrastructure: malicious .pth startup hook reaches 2,500+ orgs, 434,000 CI/CD pipelines
Researchers report TeamPCP compromised the Trivy release stream and shipped malicious LiteLLM 1.82.7 and 1.82.8 to PyPI with a SANDCLOCK credential-stealer. The download window was ~40 minutes, but a .pth startup hook auto-executed. CloudSEK tied the packages to 2,500+ organizations and 434,000 CI/CD pipeline runs.
Incident overview
In August 2026, attackers compromised the release pipeline of Aqua Security's open-source vuln scanner Trivy and delivered a malicious Trivy package into LiteLLM's build environment. LiteLLM did not pin hash-verified dependency versions, so the poisoned code shipped in LiteLLM 1.82.7 and 1.82.8 on PyPI on 12 August. CloudSEK attributes the campaign to TeamPCP and estimates that, in the ~40-minute exposure window of the two versions, as many as 2,500 organizations and 434,000 CI/CD pipeline runs touched the malicious package. Long-lived stolen credentials turn a short window into a cross-org IR event.
Technical details
LiteLLM 1.82.8 plants a .pth file as a Python startup hook on install. Any later process that starts a Python interpreter runs the malware with no explicit import. CloudSEK named the payload SANDCLOCK. On CI/CD runners it attempts privilege escalation and hunts SSH keys, cloud credentials, Kubernetes tokens, env files, secrets in process memory, and LLM API keys plus gateway config. Stolen data is encrypted then exfiltrated to attacker-controlled lookalike domains. If exfil fails, the payload creates a public repo under the victim's GitHub account and uploads the data as a Release Asset—harder to catch at the network layer.
Scope
CloudSEK's reconstructed dataset associates potentially affected orgs including NVIDIA, AWS, Samsung, Cisco, Salesforce, Siemens, FedEx, Volkswagen, Zscaler, and London Stock Exchange Group. These are high-confidence exposure-path correlations, not confirmed exfil or code execution at each company. Stolen credentials can remain valid after package takedown; rotating them in affected environments is the required immediate action. A third tool besides Trivy and LiteLLM also joined the same attack chain via the same unrevoked publish token, turning a single credential leak into ecosystem-scale exposure.
Further notes
From a governance view, this continues the TeamPCP activity the LiteLLM team disclosed on 23 July, but this time Trivy sits directly in the chain and the .pth startup hook bypasses classic import-based detection. The authors treat the AI control plane as a high-value node: model gateways, orchestrators, and SDKs already aggregate access to data, identity, and compute. For enterprises, one leaked credential now fans out across projects and up/downstream business. Treat AI-tool supply chains at the same priority as traditional OSS: pin deps to hashes, verify SBOM before build, whitelist CI runner egress.
Remediation and detection
- Locate LiteLLM 1.82.7 and 1.82.8 installs in production. Isolate associated runners, hosts, container images, and caches.
- Rotate every credential reachable by affected processes: cloud keys, repo tokens, container-registry keys, Kubernetes Service Accounts, LLM API keys. Rotate before further investigation so attackers do not keep a second-use window.
- Review CI/CD logs, container-registry logs, Kubernetes audit logs, and source-repo activity for anomalous token use, new Service Accounts, suspicious egress, and unexpected repos.
- Pin dependencies, GitHub Actions, and image tags to hash-verified versions so pipelines cannot be swapped for an upstream poisoned package again.
- In EDR/SIEM, add detections for .pth startup hooks, unexpected GitHub Release Asset uploads under the account, and encrypted egress to non-business domains.
Sources
- Open Source For U: LiteLLM Attack Exposes 434,000 CI/CD Pipelines
- NSFOCUS: LiteLLM Supply-Chain Attack May Affect 2,500 Organizations and 434,000 CI/CD Pipelines
- Tencent Security Today: LiteLLM Supply Chain Attack Analysis