A supply-chain attack targeting LiteLLM, a popular open-source AI gateway and utility library, has led to the exposure of credentials across more than 2,000 code repositories, impacting a wide range of organizations, particularly in the technology, finance, and healthcare sectors. The threat actor group, identified as TeamPCP, compromised maintainer credentials for LiteLLM and published malicious package versions 1.82.7 and 1.82.8 to PyPI around March 2026. This created an exposure window that lasted for several months.
The attack, dubbed "SANDCLOCK" by cybersecurity researchers, involved a credential-stealing backdoor planted through the compromised code repository. LiteLLM is widely used to unify API calls for over 100 large language model providers, including OpenAI, Anthropic, Google Gemini, and local Ollama models, making it a critical component in many AI applications.
Cybersecurity firm Resecurity (USA) estimates that over 2,500 organizations and hundreds of thousands of CI/CD environments suffered full-credential exposure. The compromised data includes cloud infrastructure keys, repository access tokens, SSH credentials, Kubernetes secrets, and AI provider API keys for services like OpenAI and Anthropic.
Resecurity acquired a 150GB archive attributed to the SANDCLOCK attack. Incident reports accompanying victim manifests enumerate 898 compromised GitHub owners, which include organizations and individual accounts, across 2,038 repositories. The affected entities span major global enterprises and regulated organizations.
Among the prominent organizations listed as affected are Microsoft, Azure, IBM, NVIDIA, PayPal (Zettle), Deloitte, Bosch, S&P Global, Elevance Health, 84.51° (Kroger), Adeo (Leroy Merlin), Kärcher, Dräger, ID.me, and 1inch.
The most impacted sectors, by victim organization profile, are technology/software, banking/finance/insurance, healthcare/pharma/medtech, retail/e-commerce, media/gaming/adtech, manufacturing/industrial, professional services, cybersecurity, crypto, and government.
Resecurity identified 2,146 records by key name, though the values themselves were not fully inspected beyond structural masking. The majority of these records consisted of GitHub CI/CD identity material, alongside a significant number of high-value cloud and registry credentials.
The distribution of affected repositories is long-tailed, with 631 owners having a single affected repository, while one heavily impacted owner, Cencosud-Cencommerce, had 64 affected repositories.
Organizations affected by the LiteLLM incident are strongly advised to revoke or rotate GitHub App private keys, Personal Access Tokens (PATs), AWS/GCP/Firebase credentials, ECR/JFrog tokens, SSH keys, and signing passwords, and to invalidate all active sessions. The long-term consequences of this supply-chain attack are expected to be substantial, with some victim organizations potentially still unaware of the backdoor's presence and impact.
