153GB of stolen credentials surface after LiteLLM supply chain attack
153GB archive from the LiteLLM supply chain attack exposes secrets from about 2,500 companies, including AWS, Samsung, Cisco and Salesforce.
Hudson Rock obtained and analyzed a 153GB archive stolen in the LiteLLM supply chain attack, containing 433,909 files with secrets attributed to 2,488 corporate domains, including AWS, Samsung, Cisco, Salesforce, NVIDIA, Microsoft and Siemens. TeamPCP compromised Trivy on March 19, 2026, stole LiteLLM's PyPI publishing tokens through the build pipeline, and published malicious LiteLLM versions 1.82.7 and 1.82.8 on March 24. CloudSEK separately estimated close to 2,500 exposed organizations, and Kevin Beaumont confirmed the data is legitimate. Hudson Rock is running a global ethical disclosure effort and urges organizations to rotate secrets before the trove leaks publicly.