![\"\"\/](\"https:\/\/securityaffairs.com\/wp-content\/themes\/security_affairs\/images\/user-icon.svg\"){kind=icon}
Pierluigi Paganini<\/a>\n\t\t\t\t\t\t\t
![\"\"\/](\"https:\/\/securityaffairs.com\/wp-content\/themes\/security_affairs\/images\/clock-icon.svg\"){kind=icon}
August 17, 2026<\/p>\n\t\t\t\t\t\t![\"\"\/](\"https:\/\/www.europesays.com\/uk\/wp-content\/uploads\/2026\/08\/signal-2026-08-17-18-48-09-671.jpg\")
<\/p>\n
The SANDCLOCK LiteLLM supply-chain attack exposed credentials across 2,038 repositories, affecting technology, finance, healthcare, retail and more.<\/p>\n
Resecurity (USA)<\/strong> estimated<\/a> the most affected sectors by the \u201cSANDCLOCK<\/a>\u201d backdoor<\/strong>, which was planted as a result of the code repository compromise. According to cybersecurity experts, LiteLLM <\/a>\/ TeamPCP<\/a> Supply-Chain Attack<\/strong> will have long-lasting consequences.<\/p>\n By compromising a well-known component in AI applications, adversaries will multiply the blast radius\u2014some of the victim organizations are still unaware of the backdoor and its impact. LiteLLM is a popular open-soure AI gateway<\/strong> and utility library that unifies API calls for over 100 large language model providers, such as OpenAI, Anthropic, Google Gemini,<\/strong> and local Ollama models<\/strong>.<\/p>\n Such incidents involve substantial MTTD (Mean Time to Detect) and MTTR (Mean Time to Respond). The threat actor group \u201cTeamPCP<\/a>\u201d compromised maintainer credentials for LiteLLM and published malicious package versions 1.82.7 and 1.82.8 to PyPI around March 2026 \u2013 creating a window of exposure lasting at least a few months.<\/p>\n Over 2,500+ organizations<\/strong> and hundreds of thousands of CI\/CD environments suffered full-credential exposure, compromising cloud infrastructure keys, repository access tokens, SSH credentials, Kubernetes secrets, and AI provider API keys (such as OpenAI and Anthropic).<\/p>\n Resecurity has acquired the 150GB archive<\/strong> attributed to the LiteLLM supply-chain attack conducted by TeamPCP using the \u201cSANDCLOCK\u201d credential-stealer. Per published incident reporting \u2014 accompanying victim manifests enumerate 898 compromised GitHub owners (organisations\/accounts) across 2,038 repositories. The affected owners include major global enterprises \u2014 among them Microsoft, Azure, IBM, NVIDIA, PayPal (Zettle), Deloitte, Bosch, S&P Global, Elevance Health, 84.51\u00b0 (Kroger), Adeo (Leroy Merlin), K\u00e4rcher, Dr\u00e4ger, ID.me and 1inch.<\/p>\n Top 10 the most impacted sectors (by victim organization profile):<\/p>\n Resecurity enumerated 2,146 records by key name (values never inspected beyond structural masking). The composition is overwhelmingly GitHub CI-CD identity material, with a long tail of high-value cloud and registry credentials.<\/p>\n Victim manifests (owners.txt, repos.txt) enumerate 898 distinct compromised GitHub owners across 2,038 repositories. The distribution is long-tailed: 631 owners have a single affected repo, while the most-affected owner (Cencosud-Cencommerce) has 64. Critically, the owner list includes major global enterprises and regulated organisations.<\/p>\n Every organization affected by the LiteLLM incident should revoke or rotate GitHub App private keys, PATs, AWS\/GCP\/Firebase credentials, ECR\/JFrog tokens, SSH keys, and signing passwords, and invalidate sessions.<\/p>\n Follow me on Twitter:\u00a0<\/strong>@securityaffairs<\/strong><\/a>\u00a0and\u00a0<\/strong>Facebook<\/strong><\/a>\u00a0and\u00a0<\/strong>Mastodon<\/strong><\/a>\n
![\"Resecurity](\"https:\/\/www.europesays.com\/uk\/wp-content\/uploads\/2026\/08\/Resecurity_LiteLLM_AffectedEntities_by_Sector_1.png\")
<\/a><\/p>\n![\"Resecurity](\"https:\/\/www.europesays.com\/uk\/wp-content\/uploads\/2026\/08\/Resecurity-LiteLLM-2.png\")
<\/a><\/p>\n![\"Resecurity](\"https:\/\/www.europesays.com\/uk\/wp-content\/uploads\/2026\/08\/Resecurity-LiteLLM-3.png\")
<\/a><\/p>\n