LiteLLM Supply-Chain Attack - Technology, Banking and Healthcare the Most Affected
The SANDCLOCK LiteLLM supply-chain attack exposed credentials across 2,038 repositories, affecting technology, finance, healthcare, retail and more. Resecurity (USA) estimatedthe most affected sectors by. . .
The SANDCLOCK LiteLLM supply-chain attack exposed credentials across 2,038 repositories, affecting technology, finance, healthcare, retail and more. Resecurity (USA)estimatedthe most affected sectors by the“SANDCLOCK” backdoor, which was planted as a result of the code repository compromise. According to cybersecurity experts,LiteLLM/TeamPCPSupply-Chain Attackwill have long-lasting consequences. By compromising a well-known component in AI applications, adversaries will multiply the blast radius—some of the victim organizations are still unaware of the backdoor and its impact. LiteLLM is a popularopen-soure AI gatewayand utility library that unifies API calls for over 100 large language model providers, such asOpenAI, Anthropic, Google Gemini,and localOllama models. Such incidents involve substantial MTTD (Mean Time to Detect) and MTTR (Mean Time to Respond). The threat actor group “TeamPCP” compromised maintainer credentials for LiteLLM and published malicious package versions 1. 82. 7 and 1. 82. 8 to PyPI around March 2026 – creating a window of exposure lasting at least a few months. Over 2,500+ organizationsand hundreds of thousands of CI/CD environments suffered full-credential exposure, compromising cloud infrastructure keys, repository access tokens, SSH credentials, Kubernetes secrets, and AI provider API keys (such as OpenAI and Anthropic). Resecurity has acquired the150GB archiveattributed to the LiteLLM supply-chain attack conducted by TeamPCP using the “SANDCLOCK” credential-stealer. Per published incident reporting — accompanying victim manifests enumerate 898 compromised GitHub owners (organisations/accounts) across 2,038 repositories. The affected owners include major global enterprises — among them Microsoft, Azure, IBM, NVIDIA, PayPal (Zettle), Deloitte, Bosch, S&P Global, Elevance Health, 84. 51° (Kroger), Adeo (Leroy Merlin), Kärcher, Dräger, ID. me and 1inch. Top 10 the most impacted sectors (by victim organization profile):Technology / SoftwareBanking / Finance / InsuranceHealthcare / Pharma / MedtechRetail / E-CommerceMedia / Gaming / AdtechManufacturing / IndustrialProfessional ServicesCybersecurityCryptoGovernmentResecurity enumerated 2,146 records by key name (values never inspected beyond structural masking). The composition is overwhelmingly GitHub CI-CD identity material, with a long tail of high-value cloud and registry credentials. Victim manifests (owners. txt, repos. txt) enumerate 898 distinct compromised GitHub owners across 2,038 repositories. The distribution is long-tailed: 631 owners have a single affected repo, while the most-affected owner (Cencosud-Cencommerce) has 64. Critically, the owner list includes major global enterprises and regulated organisations. Every organization affected by the LiteLLM incident should revoke or rotate GitHub App private keys, PATs, AWS/GCP/Firebase credentials, ECR/JFrog tokens, SSH keys, and signing passwords, and invalidate sessions. Follow me on Twitter:@securityaffairsandFacebookandMastodonPierluigi Paganini(SecurityAffairs– hacking, newsletter)