What was the full scope and timeline of the March 2026 LiteLLM supply chain attack, including how TeamPCP compromised the build pipeline via a poisoned Trivy scanner to publish malicious LiteLLM versions 1.82.7 and 1.82.8 on PyPI, which organizations were affected among the rough

I'll research this attack systematically, starting with the core details and then expanding to affected organizations and post-mortem findings

Here is the full scope and timeline of the March 2026 LiteLLM supply chain attack, compiled from official disclosure, threat-intelligence reports, and independent analysis.

Attack Timeline

• March 19, 2026 – TeamPCP first compromised Aqua Security's Trivy, a widely used open-source vulnerability scanner, by injecting malicious code into a Trivy dependency .
• March 24, 2026, ~10:39 UTC – LiteLLM version 1.82.7 was published to PyPI from a build pipeline that blindly trusted the now-poisoned Trivy scanner during CI/CD security scanning .
• March 24, 2026, ~10:39–11:19 UTC – Version 1.82.8 was also pushed. The malicious packages contained credential-stealing code that exfiltrated cloud credentials, SSH keys, Kubernetes configs, database credentials, API keys, and other secrets to TeamPCP's remote server .
• March 24, 2026, ~11:19 UTC – PyPI quarantined the LiteLLM project (~40 minutes after first publication), but the LiteLLM team advised treating any install up to 16:00 UTC that day as suspect . The packages were downloaded over 119,000 times during the roughly 2.5-hour window .

How the Attack Worked

TeamPCP exploited a cascading supply-chain compromise: they first poisoned Trivy (an open-source security scanner), then LiteLLM's CI/CD pipeline — which used the compromised Trivy dependency in its own build security scanning — was infected during the build process, giving the attackers LiteLLM's PyPI publish credentials . This allowed TeamPCP to push malicious releases directly to PyPI, bypassing LiteLLM's normal GitHub-based release process . One analysis noted the attack "originated from the Trivy dependency used in [LiteLLM's] CI/CD security scanning workflow" .

Scale of the Data Exfiltration

• Hudson Rock independently obtained and analyzed the attackers' raw archive: 153 GB containing 433,909 files and 118,829 CI runner dumps, attributed to 2,488 corporate domains .
• CloudSEK reconstructed approximately 434,000 captured CI/CD pipeline files and identified over 2,500 potentially exposed organizations .
• The FBI issued a flash advisory (FLASH-20260702-01) on July 2, 2026, warning of affiliated follow-on targeting .

Affected Organizations

The exposed domains included major enterprises across technology, finance, industrial, and telecom sectors. Confirmed named organizations from multiple sources include Amazon (AWS), Samsung, Cisco, Microsoft, NVIDIA, Salesforce, Volkswagen, FedEx, Deloitte, ServiceNow, S&P Global, Siemens, and BT Group . Hudson Rock noted the archive contained credentials "still valid" for many of these organizations months after the incident .

Kevin Beaumont's Post-Incident Testing

After the Ars Technica report on the breach, Kevin Beaumont independently tested compromised credentials from a major US technology company that claimed it had "rotated everything." Using a responsible-disclosure policy, he tested the credentials and found that "almost every one worked" — meaning the organization had not actually rotated its compromised secrets despite claiming otherwise .

Urgent Recommendation

Treat all secrets, API keys, cloud credentials, SSH keys, Kubernetes configurations, and any other sensitive data that were accessible to LiteLLM versions 1.82.7 or 1.82.8 as fully compromised. Immediate rotation of every credential that could have been exposed during the March 24, 2026 window is essential — regardless of whether an organization believes it rotated them already . The attack is considered the largest AI infrastructure supply-chain breach of 2026, and the stolen data remains a persistent threat for follow-on intrusions, as demonstrated by Beaumont's credential testing .