LiteLLM Supply‑Chain Attack Exposes Credentials in 2,038 GitHub Repositories Across Tech, Finance & Healthcare
What Happened – Threat actors behind the “TeamPCP” group stole maintainer credentials for the open‑source LiteLLM library and pushed malicious versions (1.82.7, 1.82.8) to PyPI in March 2026. The back‑door, dubbed “SANDCLOCK”, harvested cloud keys, CI/CD tokens, SSH keys, Kubernetes secrets and LLM API keys from more than 2,500 organizations, affecting 898 GitHub owners and 2,038 repositories.
Why It Matters for Compliance & Audit Readiness
- Credential theft at the supply‑chain level is a textbook SOC 2 Access Control failure (CC6.1 – logical access is not adequately restricted).
- Continuous‑compliance programs must prove that privileged accounts are monitored, rotated, and that third‑party code is vetted – evidence that can be captured in real‑time with Verisq’s access‑control monitoring.
- The incident highlights the need for auditable security‑awareness training that covers credential hygiene for developers and DevOps teams.
Who Is Affected – Technology/software firms, banking & finance institutions, healthcare & pharma providers, retail/e‑commerce platforms, media, manufacturing, professional services, cybersecurity vendors, crypto firms and government agencies.
Recommended Actions
- Map the incident to SOC 2 CC6.1 and CC6.2 controls; verify that privileged‑access reviews, MFA enforcement and least‑privilege policies are in place.
- Deploy continuous credential‑use monitoring for all CI/CD pipelines and third‑party libraries; collect logs as audit evidence.
- Conduct targeted security‑awareness training for developers on supply‑chain hygiene and credential management.
Technical Notes – The attackers leveraged stolen maintainer credentials (STOLEN_CREDENTIALS) to publish malicious packages to PyPI (MALWARE). The back‑door harvested API keys for OpenAI, Anthropic, Google Gemini and others, as well as cloud provider access tokens and Kubernetes secrets. No public CVE is associated because the flaw resides in the compromised development workflow rather than a product bug. Source: Security Affairs