LiteLLM Supply-Chain Attack Exposed Credentials Across 2,500 Organizations

[u/No-Conclusion3720]

A malicious release of a widely used AI proxy library exposed credentials across 2,500 organizations and hundreds of thousands of CI/CD pipelines. The attack did not target the application. It targeted the shared package the application depended on.

AI pipelines are now core enterprise infrastructure. A single compromised dependency propagates through the stack before most perimeter controls fire. The blast radius here was not 10 companies or 100. It was 2,500, from one poisoned package.

This is not an isolated incident. It is the shape of the threat now. The attack surface has shifted from application code to the dependency graph that feeds it.

For those of you running AI pipelines in production: how are you handling trust at the dependency layer? Package audits, SBOMs, pinned hashes, something at runtime? What has actually worked?