Two compromised versions of LiteLLM, 1.82.7 and 1.82.8, sat in the Python Package Index for about forty minutes in March. That window produced a 195TB file, credentials from 434,000 CI/CD pipelines, and confirmed exposure at Nvidia, AWS, Samsung, Cisco, Siemens, FedEx, and the London Stock Exchange Group. CloudSEK and Hudson Rock published the details Tuesday and Wednesday.
Forty minutes is the number in every headline. Twenty days is the number that explains it.
LiteLLM was not the first link. The attackers reached PyPI through Trivy, the vulnerability scanner a great many teams run for the specific purpose of catching this class of problem. CloudSEK's account of how: Trivy's maintainers rotated a compromised automation token and did not fully revoke it. Rotation issues a new credential. Revocation kills the old one. For twenty days both authenticated, and the attackers spent that window force-pushing malicious code into third-party builds — LiteLLM, KICS, the Telnyx Python SDK.
Now read the remediation notice. Hudson Rock is telling every affected organization to perform aggressive credential revocation: invalidate and rotate all cloud keys, Kubernetes service account tokens, GitLab and GitHub PATs. Twenty-five hundred companies are being handed the same instruction whose incomplete execution started this.
Kevin Beaumont checked one of them.
One of the orgs impacted told me they'd rotated them all and it's a nothingburger, so I looked at their responsible disclosure policy, it allows trying creds, so I tried them all. Almost every one worked.Kevin Beaumont
That is a company that believes it has remediated. It filed no correction because nothing told it otherwise. A rotated key leaves a record in your secrets manager; a still-live key leaves no record anywhere until someone authenticates with it. The organization's confidence and its exposure were both real at the same time, and only one of them was visible from the inside.
And the notice only reaches the companies someone could name. Both firms said large stretches of the dump hold active database passwords, third-party API keys, and cloud credentials carrying no company email, no custom domain, no internal server name — generically configured pipelines that leak secrets without leaking whose they are. One address in the dump from siriusxm.com turned out to belong not to the broadcaster but to its subsidiary AdsWizz. The published victim list is the portion of this breach that happened to be legible.
A rotated key leaves a record in your secrets manager; a still-live key leaves no record anywhere until someone authenticates with it.
The obvious objection is that this one company was sloppy, and no procedure survives people who don't follow it. Concede the sloppiness — it doesn't get you out. Trivy's maintainers ship security tooling for a living, and the distinction between rotating and revoking didn't survive contact with them either. When the people whose job is credential hygiene and the victims cleaning up after them fail in the same direction, the problem is not discipline. "Rotate your credentials" is an instruction with no completion criteria, issued to thousands of teams, at the end of an incident caused by an instruction with no completion criteria.
Beaumont's method is the entire remediation program, and it takes one command. Take the old credential. Try to use it. Failure is the only receipt.