Supply Chain Attack on LiteLLM Exposes 153 GB of Credentials Across 2,500 Organizations
What Happened — Attackers compromised the open‑source Trivy scanner, used its build pipeline to inject malicious versions of the LiteLLM proxy gateway (v1.82.7 & v1.82.8) into PyPI, and harvested PyPI publishing tokens. Those tokens allowed the threat group to steal runtime secrets from thousands of CI runners, resulting in a 153 GB archive of AWS keys, Azure variables, Salesforce client secrets, Slack signing secrets, and other credentials linked to roughly 2,500 corporate domains.
Why It Matters for Compliance & Audit Readiness
- The incident is a textbook example of a supply‑chain breach that bypasses perimeter defenses and directly compromises secret management – a control area covered by SOC 2 CC6 (Logical Access) and CC7 (System Operations).
- Continuous evidence of secret‑rotation policies, CI/CD integrity checks, and third‑party component vetting is essential to demonstrate due diligence during a SOC 2 audit.
- Verisq’s SOC2 Access Controls capability can help you collect immutable logs of token usage, automate secret‑rotation evidence, and provide audit‑ready reports that prove you’re meeting the “least‑privilege” and “change management” criteria.
Who Is Affected — Cloud‑infrastructure providers (AWS, Azure), SaaS platforms (Salesforce, Slack), large enterprises across tech, manufacturing, logistics, and finance (e.g., Cisco, Samsung, Microsoft, Volkswagen, FedEx).
Recommended Actions
- Inventory all third‑party packages in your CI pipelines; enforce signed releases and hash verification.
- Rotate any secrets that may have been exposed (access keys, API tokens, signing secrets) and enforce short‑lived credentials.
- Enable continuous monitoring of PyPI releases for your internal packages and integrate alerts into your SOC 2 control evidence collection.
- Document the incident response steps and update your logical‑access policies to reflect supply‑chain risk mitigation.
- Conduct a SOC 2 access‑control readiness review focused on secret‑management and CI/CD integrity.
Technical Notes — Attack vector: compromised third‑party dependency (Trivy) → malicious LiteLLM releases → stolen PyPI publishing tokens → credential exfiltration. No specific CVE disclosed; the vulnerability lies in the trust model of open‑source build pipelines. Data types: cloud provider secret keys, SaaS client secrets, CI runner environment variables, AI model API keys.
Source: Help Net Security