A supply-chain compromise of LiteLLM, an open source tool used in AI-driven software development, exposed large volumes of credentials from organizations using infected package versions, according to Ars Technica. The report says the exposed secrets included data tied to major companies such as Microsoft, Amazon, Cisco, Samsung, and Salesforce, based on findings posted by security firms CloudSEK and Hudson Rock. CloudSEK said it found cloud keys, repository tokens, Secure Shell keys, Kubernetes secrets, package publishing credentials, environment variables, and AI provider keys that could have given attackers access to more than 2,500 organizations, Ars reports. Hudson Rock said it identified the exposure after analyzing a 195TB file it obtained. Ars says neither firm identified the source of that file. The reported theft occurred during a 40-minute window in March, when victims used compromised versions of LiteLLM downloaded from the package’s official listing in the Python Package Index repository. According to Ars, the malicious package versions accessed memory on infected machines, scraped its contents, and sent the data out through an attacker-controlled channel. The incident is not described as an isolated package compromise. Ars reports that the LiteLLM attack stemmed from an earlier supply-chain campaign that infected Trivy, a widely used vulnerability scanner. Other software affected in the same campaign included KICS and the Telnyx Python SDK. TeamPCP, which Ars describes as a capable gang largely made up of teenagers, claimed responsibility for the campaign, and researchers have largely corroborated that claim, according to the report. Independent security researcher Kevin Beaumont also said he had confirmed the legitimacy of the data across multiple victim organizations, Ars reports. The scale is notable because the affected data was not limited to one application’s login records. Ars says the dump contained credentials embedded across software delivery environments, including secrets used by continuous integration and continuous delivery systems. CloudSEK and Hudson Rock said about 434,000 CI/CD pipelines had credentials exposed after running the compromised LiteLLM versions. Attribution remains difficult. Ars notes that researchers had trouble mapping many exposed credentials to the organizations that actually owned them, because CI/CD environments can use generic variables without clear company identifiers. One example in the report involved an address using the siriusxm.com domain that ultimately pointed to infrastructure belonging to AdsWizz, a SiriusXM subsidiary, rather than to the broadcaster directly. For operators, the operational message is narrow but serious: package provenance and secret handling in AI-adjacent development pipelines are now part of the attack surface. The report does not establish which credentials remain active, which organizations have rotated secrets, or whether attackers used the exposed material beyond exfiltration, so those questions remain open. Who benefits: Security teams, cloud-security vendors, and software-supply-chain monitoring providers gain a fresh case for tighter package verification and secret scanning. Organizations already tracking dependency integrity and rotating credentials quickly are better positioned. Who's exposed: Teams that ran compromised LiteLLM versions during the March window are directly exposed, according to Ars. Organizations with generic CI/CD variables and poorly attributable secrets may face a harder incident-response process.