Security firm CloudSEK published research on 12 August reconstructing the blast radius of the March compromise of LiteLLM, the widely used LLM gateway library. Its figure: roughly 434,000 CI/CD pipelines, mapping to more than 2,500 organisations.
Forty minutes
Malicious versions 1.82.7 and 1.82.8 were live on PyPI from 10:39 UTC on 24 March for about 40 minutes, though CloudSEK advises treating any install up to 16:00 UTC that day as suspect. The vulnerability is tracked as CVE-2026-33634 and was added to CISA's Known Exploited Vulnerabilities catalogue on 26 March.
The mechanism worth understanding
Version 1.82.8 dropped a file named litellm_init.pth. Files with that extension are executed by Python at interpreter startup — so the payload ran on any Python process in the environment, whether or not LiteLLM was ever imported. Collected material was encrypted in transit to models.litellm[.]cloud.
Three tools deep
The chain began with a breach of Aqua Security's Trivy scanner. LiteLLM's own CI pipeline automatically installed the compromised Trivy, which then poisoned the LiteLLM release. CloudSEK's summary: "Trivy, then the build system, then the LiteLLM release: one unrevoked token, three tools deep." The activity is attributed to TeamPCP, tracked by Google as UNC6780.
What was reachable
Cloud keys for AWS, GCP and Azure, SSH keys, Kubernetes tokens, database passwords, LLM provider API keys, CI/CD deployment secrets and package-publishing credentials. Nvidia, Cisco, Samsung, Siemens, FedEx and Volkswagen appear among the organisations mapped.
What this research is not
The compromise itself is five months old; the news is the reconstruction. CloudSEK is explicit that the figures describe reconstructed potential exposure, not proof that any named company was breached or that every credential was taken. It is also vendor research published alongside a lead-generating exposure checker, with no independent replication of the dataset.