The use of artificial intelligence and open-source software in modern application development is becoming increasingly widespread and continues to grow rapidly. At the same time, the dependencies integrated into the development process are expanding an organization’s attack surface.
Digital Vault Recently disclosed research shows how AI-powered supply chains have become a pathway for attackers to expand their scope of attacks from software dependencies to CI/CD environments, cloud infrastructure, source code repositories, and enterprise AI infrastructure.
Background of the Incident and Scope of Impact
Digital Vault An analysis of a supply chain attack involving LiteLLM estimated that, following an attack campaign in March 2026, more than 2,500 organizations and approximately 434,000 CI/CD pipelines were included in the dataset of potentially compromised entities. The attack campaign was linked to the threat actor group TeamPCP.
However, it is important to note that these data are based on a reconstructed exposure dataset.Digital Vault It is important to note that this data should not be interpreted as evidence that all listed organizations have been successfully compromised or that credentials for all organizations have been stolen. Therefore, organizations appearing in the dataset should be considered as potentially compromised, and further internal investigations are required before concluding that a security breach has actually occurred.
If your organization appears in the dataset, we recommend that you immediately review your build and dependency history, identify any credentials that may have been compromised, review relevant logs, and based onDigital VaultThe confidential rotation mechanism quickly updates the risk keys.
How do supply chain attacks spread to other systems?
Digital Vault According to the report, Trivy, a security scanner used in the upstream development process, was compromised by attackers. The incident involved a leaked automation token that had been rotated but not fully revoked, allowing attackers to replace the code behind what appeared to be legitimate version tags.
The LiteLLM CI pipeline did not enforce strict enough dependency locking during the installation of Trivy. As a result, a compromised scanner was automatically introduced into the build process, ultimately leading to the creation and release of affected LiteLLM versions 1.82.7 and 1.82.8 on PyPI.
The affected package remained on PyPI for approximately 40 minutes. However, because the CI/CD environment runs automatically, scheduled jobs, dependency resolvers, build runners, developers' machines, and caching layers could quickly download the package and distribute it to other environments.
Key Point: The payload can operate without being detected
One of the most important technical details is that the malicious payload is delivered via .pth via file transfer.
据 Digital Vault Analysis shows that such files can be executed when the Python interpreter starts, without the need for an explicit LiteLLM import statement. This means that even if an application never directly imports LiteLLM, an environment with the affected package installed could still execute a malicious payload.
Credentials and confidential information are the primary targets of attacks
The primary risk posed by this incident lies not only in the compromised software package itself, but also in the data and permissions accessible to the affected CI/CD runners or environments.
Digital Vault According to the report, a credential-stealing program tracked by Google, known as SANDCLOCK, is capable of detecting and collecting sensitive information from affected CI runners.
Information that may have been compromised includes:
AWS, Google Cloud, and Microsoft Azure Cloud Credentials
GitHub/GitLab tokens, SSH keys, and deployment keys
Kubernetes Tokens and Service Accounts
Environment variables,
.envFiles and CI/CD KeysSoftware Package Releases and Container Registry Credentials
Database, SaaS, and Webhook Credentials
LLM API Keys and AI Gateway Credentials
Private source code, build images, and build artifacts
Digital Vault It also noted that some cloud credentials can be accessed through the instance metadata service, while Kubernetes tokens can be obtained through the mounted service account path. This means that if a compromised process already has access to these credentials, an attacker would not need to exploit additional vulnerabilities to achieve lateral movement.
Why Is Artificial Intelligence Infrastructure Becoming a High-Value Target?
Artificial intelligence infrastructure in modern enterprises is increasingly becoming the convergence point for data, identity, computing, and automation. AI gateways, agent runtimes, model endpoints, vector databases, and MCP servers can simultaneously connect to model providers, cloud services, databases, plugins, and internal business applications.
In addition, agent-based AI workflows may have permissions to read and write data, invoke tools, or automatically trigger business processes. Once an attacker obtains compromised credentials, this significantly expands the potential scope of the impact.
Another challenge is that organizations may adopt AI services faster than security teams can build and maintain a comprehensive inventory of assets. This can lead to the emergence of “shadow AI,” unknown AI assets, and unmanaged credentials—all of which remain outside the scope of security teams’ monitoring.
Corporate Response Strategies and Recommendations for Action
Organizations using LiteLLM, or those with CI/CD environments that may be affected by this incident, should first determine whether their environments are using LiteLLM version 1.82.7 or 1.82.8.
If potential risks are identified, we recommend taking the following measures:
Full-Scale Key Rotation: With the help ofDigital VaultRotate all credentials accessible to affected processes or CI/CD runners with a single click (not limited to LLM credentials).
Log Auditing: View audit logs for cloud platforms, source code control systems, software package repositories, and Kubernetes or clusters.
Isolation and Reconstruction: Isolate any running programs, hosts, images, or caches that may be affected, and rebuild the environment from a known clean source.
Dynamic Vouchering: With the help ofDigital VaultShorten the validity period of credentials and replace static, long-term keys hard-coded in configuration files with dynamic workload identifiers (such as OIDC or short-term tokens).
Dependency Locking: Use verified hash values to secure dependencies and GitHub Actions, preventing automated builds from producing malicious packages.
Leveraging Digital Vaults to Strengthen AI Supply Chain and Confidentiality Security Defenses
In the age of artificial intelligence, cybersecurity can no longer focus solely on internally developed systems. Every library, software package, SDK, model provider, plugin, and third-party service related to development and the AI ecosystem has the potential to become part of an organization’s attack surface.
Digital Vault Committed to providing full-lifecycleSecret Management, Dynamic Key Rotation, and AI Supply Chain Risk Management
Before risks are exploited as attack vectors, understand them and, through Digital Vault Strengthen the security of your digital and AI supply chains.
Contact us:www.sest.com.hk | info@sest.com.hk
DVT Digital Vault - Over 20 years of chip-level encryption technology to accumulate data sovereignty, starting now.
