Stolen Credential Archive From LiteLLM Breach Remains Active
The 153GB dump contains secrets for 2,488 organizations, leaving enterprise infrastructure vulnerable months after the attack.
Updated on Oct. 21, 2026 in Cybersecurity
Live Poll
Do you trust that the software tools used by your workplace are adequately secured against hacking?
A 153GB archive of stolen credentials linked to the March 2026 LiteLLM supply-chain attack remains accessible. The leak contains over 433,000 files from 2,488 organizations, exposing sensitive keys and secrets that were harvested via trojanized software packages.
Why it matters
The breach highlights the systemic risks of modern CI/CD pipelines, where compromising a single widely-used dependency like LiteLLM allows attackers to harvest high-value credentials across thousands of enterprises. Despite the arrests of the suspected perpetrators, the continued availability of the stolen data poses a persistent security threat to the affected organizations.
The archive contains 153GB of data, including environment variables, SSH keys, Kubernetes secrets, and database passwords. This resulted in 500,000 logged exfiltration events harvested from trojanized versions 1.82.7 and 1.82.8 of the LiteLLM library.
The players
LiteLLM
An open-source library used to unify API calls for large language models that processes 95 million downloads monthly.
Trivy
A vulnerability scanner for containers and CI/CD pipelines whose action tags were exploited to distribute malicious code.
Checkmarx KICS
An open-source static analysis tool for infrastructure-as-code security that was compromised by the attackers.
Aqua Security
A cloud-native security firm whose incomplete credential rotation was exploited by the TeamPCP attackers.
The details
Attackers used a poisoned security scanner to hijack PyPI publishing keys, allowing them to push malicious code into Python .pth files. These files execute arbitrary commands upon interpreter startup, which attackers leveraged to scrape system secrets. The operation relied on exploiting incomplete credential rotation at Aqua Security, alongside compromised access to Trivy and Checkmarx KICS tools.
Timeline
March 19, 2026: Attackers pushed malicious commits into Trivy tags.
March 23, 2026: Attackers compromised Checkmarx KICS.
March 24, 2026: Attackers compromised LiteLLM and pushed trojanized releases.
July 2, 2026: The FBI issued an advisory urging the rotation of CI/CD secrets.
August 2026: Researchers confirmed credentials in the archive remained valid.
The Tech Race
The incident demonstrates a critical failure in the automated trust models of software supply chains. It highlights a recurring race between attackers exploiting CI/CD integration points and organizations attempting to patch credential exposure before exploitation occurs.
Organizations relying on LiteLLM, Trivy, or Checkmarx KICS in their CI/CD workflows must immediately audit and rotate all stored secrets, SSH keys, and API tokens. The risk remains high as the 153GB archive of stolen data persists in circulation, potentially allowing unauthorized access to infrastructure belonging to the 2,488 identified affected organizations.
The takeaway
The persistence of this credential archive proves that a single dependency breach provides a long-term foothold for attackers in global corporate networks. Security teams should prioritize moving toward short-lived, automatically rotated secrets to mitigate the impact of future supply-chain compromises.
Further reading
For broader insights on defending software pipelines, see our coverage in Cybersecurity.
Live Poll
Do you trust that the software tools used by your workplace are adequately secured against hacking?
