2,488 Firms, 434K Pipelines: The LiteLLM Supply Chain Blast Radius Mapped

CloudSEK published a threat intelligence report on August 11 that maps the full blast radius of the March 2026 LiteLLM PyPI supply chain compromise. The numbers: approximately 2,488 organizations and 434,000 CI pipelines were impacted. Hudson Rock independently confirmed the findings and called it the largest AI supply chain breach of 2026.

If you ran LiteLLM in your CI environment during the March 2026 timeframe, this is your problem — even if you patched CVE-2026-42271 the day it dropped. The supply chain attack and the CVE are two independent compromises on the same product, and the supply chain attack ran before the CVE was even discovered.

The two incidents, clearly separated

These are separate incidents with separate root causes, and any analysis that conflates them misses the point:

The supply chain attack operated at the package distribution layer — the malicious code ran when you installed LiteLLM via pip, before any request ever hit the LiteLLM API. The CVE operates at the application layer — the vulnerability is in LiteLLM's running code, exploitable by anyone who can reach the HTTP endpoint.

An organization that ran LiteLLM in March 2026 may have had CI secrets, API keys, and development credentials exfiltrated at the package install layer. Then, if they hadn't patched to v1.83.7+, they were still exposed to the RCE. Two attack surfaces, same product, same quarter.

What the 2,488 number means in practice

2,488 organizations. 434,000 CI pipelines. To put that in context:

• LiteLLM has approximately 45,000+ GitHub stars. Not every star is a production deployment, but 2,488 organizations represents a meaningful share of the active install base.
• 434,000 CI pipelines means 434,000 environments where CI/CD secrets — AWS keys, GCP service accounts, GitHub tokens, Docker credentials, private registry passwords — may have been exfiltrated.
• The exfiltration happened at pip install time. No request to LiteLLM's API was needed. No vulnerability in the running application was needed. The package itself was the attack vector.

For any organization in that 2,488-firm blast radius, the remediation path is not "patch LiteLLM." It's:

1. Audit every CI pipeline that ran a pip install involving LiteLLM in the March 2026 window.
2. Rotate every credential those pipelines had access to — not just the AI provider API keys. Every cloud credential, every registry token, every deployment secret.
3. Review access logs for anomalous outbound traffic during the March 2026 window — the exfiltration had to go somewhere.
4. Consider every secret in every affected pipeline compromised until proven otherwise.

Why this keeps happening to Python-distributed AI infrastructure

The attack vector in the TeamPCP incident is not a bug in LiteLLM's code. It's a structural property of how Python packages are distributed:

1. LiteLLM is distributed via PyPI.
2. Python packages declare dependencies that are automatically resolved and installed.
3. A compromised transitive dependency — even one LiteLLM never directly imported — executes code on installation.
4. The .pth import hooks ensure the malicious code persists across Python process restarts.

This is not a LiteLLM problem. It's a Python packaging problem. Any PyPI-distributed AI infrastructure package has the same attack surface. The larger and more popular the package, the more attractive the target — because the blast radius scales with the install base.

Compiled binaries — Go, Rust, C — do not have this attack class. A Go binary is a single statically-linked artifact. Installing it does not transitively pull in other packages. There is no pip install equivalent that runs arbitrary code on installation. The attack surface for a compiled binary is the binary itself, not its dependency tree.

The architectural question buyers should be asking

When an organization evaluates an AI gateway — open source or commercial — the security questions typically focus on the application: authentication, authorization, encryption, API key storage, network exposure. These are necessary questions. But the LiteLLM TeamPCP incident reveals a question that's equally important and rarely asked:

How is this software distributed, and what attack surface does the distribution mechanism create?

The answer for any PyPI-distributed Python package is: "the transitive dependency tree is part of the attack surface, and a compromise in any dependency runs code in your environment at install time."

The answer for a compiled Go binary distributed via a package registry or direct download is: "the binary is the attack surface. There is no transitive dependency execution at install time."

This is not a theoretical distinction. The TeamPCP attack is the documented proof that the distinction matters.

The combined picture for procurement teams

The LiteLLM incidents — both of them — give procurement teams the most complete reference case for AI gateway security evaluation in 2026. The questions:

1. Distribution mechanism: Is the gateway distributed as a compiled binary or as a Python package with a transitive dependency tree? The former has no supply chain install-time attack surface. The latter does — as 2,488 firms learned.
2. Credential storage: Are provider API keys stored in a separate KMS/Secret Manager with signed internal access, or in the same database that backs the web-facing API? The former survives an application-level compromise. The latter doesn't.
3. Default network posture: Is the gateway default-locked or default-open? A CVSS 10.0 in a default-locked deployment is a bad day. The same vulnerability in a default-open deployment is a credential spill.
4. CVE response cadence: How fast did the project patch a CVSS 10.0 with active exploitation? Hours, days, or weeks?
5. Single-instance blast radius: If one gateway instance is compromised, what's the damage? Can the attacker access every provider key, or just the keys on that instance? Is there credential rotation, audit logging, and network segmentation?

The bottom line

2,488 organizations. 434,000 CI pipelines. Those are the numbers that should be in every AI gateway procurement document. Not because LiteLLM is uniquely bad — it isn't — but because those numbers describe what happens when the distribution mechanism is the attack surface and the install base is large enough to be worth attacking.

The combined picture — a CVSS 10.0 RCE and a supply chain attack that hit 2,488 firms — is the most complete security evaluation reference case the AI gateway market has produced. Use it. Ask the five questions. Get the answers in writing. The cost of asking is 30 minutes. The cost of not asking is a credential rotation across 434,000 pipelines.

Trimio is distributed as a compiled Go binary. Provider API keys are held in Google Secret Manager, accessed via signed internal calls — never in the application database. The proxy is default-locked. These are not marketing claims. They are architectural choices that eliminate the attack surfaces documented in this post. See how it works.