Supply chain attack on LiteLLM exposes terabytes of credentials from major organizations

Security researchers from CloudSEK and Hudson Rock discovered a massive supply-chain attack on LiteLLM, an open-source development tool for AI applications. The breach exposed terabytes of sensitive data including cloud keys, repository tokens, SSH keys, Kubernetes secrets, and AI provider credentials belonging to over 2,500 organizations. Affected entities include Microsoft, Amazon, Cisco, Samsung, and Salesforce. The exposure occurred during a 40-minute window in March when attackers compromised LiteLLM packages downloaded from the official Python Package Index repository, allowing potential unauthorized access to critical infrastructure.