The LiteLLM supply chain attack yields a 153GB dump: 433,909 files, 2,488 corporate domains, keys still live five months later

Hudson Rock got hold of the archive and counted it. 433,909 files. 118,829 CI runner dumps traced to 2,488 corporate domains. AWS keys, Salesforce client secrets, Slack signing secrets, Azure environment variables, and AI provider API keys belonging to NVIDIA, Volkswagen, Microsoft, FedEx, Samsung, Cisco, and Salesforce. Many of those credentials reportedly still work. Help Net Security

The attack itself was March 2026 and lasted about 40 minutes. TeamPCP compromised the Trivy scanner on March 19 to steal publishing credentials, then pushed poisoned LiteLLM versions 1.82.7 and 1.82.8 to PyPI. Forty minutes on the index. About 434,000 pipelines compromised.

Blast radius is the entire story, and it's a structural point about architecture rather than a generic "watch your dependencies" warning. An LLM proxy gateway is the single worst place in your stack to take a supply chain hit, because of what it is. You put a gateway there specifically to centralize every model credential. Then you run it in CI, where it also sees your cloud keys, your registry tokens, and your environment. The design that makes a proxy useful is the design that makes it a credential jackpot. That's not LiteLLM's fault as a project. It's what the category is.

What to do, in order. Rotate anything that touched LiteLLM 1.82.7 or 1.82.8, and treat five months of elapsed time as meaning the credentials are known, not stale. Then take the harder step: get your model keys out of your CI environment. Your gateway does not need to run inside the same process boundary as your build. A separate service with its own credential scope, reachable over the network, is more moving parts and a much smaller hole.

Then look at where else this shape exists in your stack. Anything you deployed to centralize secrets has the same property. Vault sidecars, .env loaders, MCP servers holding OAuth tokens for six SaaS products. The centralizing thing is always the target.

Two related items landed the same week and rhyme with this. Cloudflare now fingerprints MCP traffic at the protocol level, keying on the MCP-Protocol-Version header that conforming clients must send after initialization, plus Mcp-Method and Mcp-Name headers that show which tool is being invoked without body inspection. Cloudflare And a new tool, skilldoctor, appeared August 13 to lint and security-audit agent skills in CI, reaching 138 stars and three releases in under 48 hours. GitHub

The agent stack is growing its scanning layer about two years after it needed one.