A supply chain attack on the popular LiteLLM library had far-reaching consequences back in March this year. Attackers injected compromised packages into the Python Package Index (PyPI), which were then downloaded and used tens of thousands of times by automated build systems, at more than 2,500 companies, some of them well known. The compromised packages were online for only about 40 minutes.
434,000 build pipelines affected
In a blog post, security researchers at CloudSEK estimate that attackers potentially infiltrated around 434,000 automated developer build pipelines used at more than 2,500 companies. The available data shows attackers could have accessed these pipelines, but doesn't conclusively prove they did so or stole all the credentials. The threat remains current regardless: the FBI warned back in July that actors linked to the TeamPCP cyber gang are likely to keep abusing stolen credentials long after the original attack. Affected organizations should therefore change their credentials, close the possible vulnerability, and harden their systems.
The list of affected companies includes names like Airbus, Amazon Web Services, Cisco, Hoffmann-La Roche, Salesforce, Samsung, ServiceNow, and Siemens, as well as Epic Games, FedEx, reinsurance giant Munich Re, Robert Bosch, Thales Group, Volkswagen, and X Corp. At these and many other companies, the automated build systems ran the compromised package versions at least temporarily, in some cases thousands of times. From some of those affected, the attackers also managed to steal secrets such as credentials.
What the attackers stole
According to CloudSEK, the stolen data includes cloud keys, repository tokens, SSH keys, Kubernetes secrets, package-publishing credentials, environment variables, and AI provider keys. Simply removing the malicious packages isn't enough, since such credentials often remain usable for weeks or months if they aren't actively rotated and nobody checks for signs of unauthorized activity.
The infostealer malware involved, which Google calls "Sandclock," ran on the compromised build systems, escalated its privileges to root, and then searched specifically for usable data. On AI build systems in particular, it hunted for LLM API keys and gateway configurations. The attackers encrypted the stolen data with AES-256 and a hardcoded RSA-4096 key and sent it to servers using a typosquatting domain. If exfiltration fails, the malware instead creates a public repository in the victim's own GitHub account and uploads the data there. If you use LiteLLM, you should check your build pipelines for suspicious activity and rotate all credentials as a precaution.