Two poisoned LiteLLM releases drained credentials from 2,500 orgs and 434,000 CI/CD pipelines

The token was rotated. It was never revoked. That gap was about twenty days wide, and it was enough.

CloudSEK disclosed that Team PCP compromised LiteLLM PyPI versions 1.82.7 and 1.82.8 by taking over the Trivy security scanner inside LiteLLM's build process. The mechanism: a leaked automation token that had been rotated but not fully revoked, leaving a window to force-push malicious code over Trivy's published version tags. Roughly 2,500 organizations and 434,000 CI/CD pipelines are potentially exposed. Harvested material includes AWS, GCP, and Azure credentials, SSH keys, Kubernetes tokens, and LLM API keys.

The detail that makes this genuinely nasty: where exfiltration to the attackers' typosquatted domain failed, the malware created a public repo inside the victim's own GitHub account and uploaded the stolen data as a release asset. Your credentials leaked from a repo you own, under your name, through an API call your automation had every right to make. Nothing in that flow looks anomalous to a naive detector.

The FBI's July FLASH advisory makes the obvious point that most incident response skips: those credentials get weaponized long after the breach. Rotating what you think was exposed is not the same as rotating everything the compromised runner could see.

This converges with something Known Agents flagged on HN (285 points): an active campaign spoofing ClaudeBot and GPTBot user-agents to mass-scan for /.config/anthropic/credentials/default.json, /.claude/settings.json, /.aws/credentials, and .env variants. Measured spoof rates are low (ClaudeBot 0.1%, Googlebot 0.5%), but ClaudeBot is 3.2% of all observed traffic and 27% of AI scraping, which is exactly why it's the identity worth stealing. Your agent config paths are in an attacker's wordlist now.

Two actions. First: pin LiteLLM, audit whether 1.82.7 or 1.82.8 ever entered a build, and if so rotate everything that runner could reach, not just what you think it touched. Check your GitHub account for public repos you didn't create. Second: make sure no agent config directory is reachable from a web-served path. Both of these take under an hour and the downside of skipping them is unbounded.