Terabytes of credentials leaked — LiteLLM supply chain
Published: August 2026 — Ars Technica
Independent mainstream confirmation:
- CloudSEK + Hudson Rock reporting
- ~434,000 CI/CD pipelines; 2,500+ orgs
- 40-minute PyPI window in March
- Also infected: KICS, Telnyx Python SDK
- Kevin Beaumont update: major US techco claimed full rotation; almost every tested cred still worked
- Alon Gal (Hudson Rock): single upstream breach → thousands of companies simultaneously