The March compromise of litellm lasted about 40 minutes on PyPI. This week we learned what the attackers stole in that time.
On August 12, 2026, Hudson Rock published its analysis of the exfiltration archive: a 153GB RAR containing 433,909 files. Its researchers attributed 118,829 CI runner dumps to 2,488 corporate domains. CloudSEK published parallel victim research on August 11, covering the same campaign from its own intelligence sources.
Neither report is about malware behavior. That was documented in March. These are about the loot.
The blast radius, now measured
In March we wrote about the LiteLLM supply chain attack when the infostealer harvested everything an attacker could want. We listed SSH keys, cloud credentials, Docker configuration, and crypto wallet data, and said the blast radius was likely significant. That was an inference from malware analysis. The archive turns it into counts.
On each compromised runner, the payload escalated to root. It swept SSH keys, AWS, GCP, and Azure credentials, Kubernetes service account tokens, .env files, and CI/CD secrets. On AI builds, it also took LLM API keys and gateway configuration, which is access to an organization's entire model stack rather than one credential.
In March we said the keys to your infrastructure were potentially in the hands of threat actors. Five months later, the qualifier is gone. 118,829 runner dumps, 2,488 organizations, one 40-minute window.
What is inside the dump
Hudson Rock's write-up shows environment dumps captured mid-execution:
AWS_SECRET_ACCESS_KEYSALESFORCE_CLIENT_SECRETSLACK_SIGNING_SECRET- Azure environment credentials
- AI provider API keys
GITLAB_USER_EMAILandCI_SERVER_FQDN, which is how attribution can be done
In one example, Hudson Rock reports a single organization with 17 compromised pipeline dumps exposing Bitbucket deployment tokens, Elastic API keys, internal JWTs, and NPM tokens. Publishing credentials in the loot is how a supply chain incident becomes a second supply chain incident.
The half nobody can attribute
The most useful finding in either report is a negative one.
Hudson Rock does not put a number on it, but reports that many dumps carry live database passwords, cloud credentials, and third-party API keys with no company email, no custom domain, and no internal hostname. Those records cannot be attributed to anyone. The organizations behind them will appear on no victim list and will receive no disclosure email.
Attributed records can still mislead. Hudson Rock describes a pipeline whose committer email ended in @siriusxm.com, while the environment dump pointed to gitlab.adswizz.com and a matching registry host. The breach sat in AdsWizz infrastructure, a SiriusXM subsidiary. Routing an alert on the email alone reaches the wrong security team.
Hudson Rock ran an ethical disclosure program. CloudSEK published a public lookup tool. Neither can notify a company it cannot name. Responsible disclosure needs an address, and a generically configured runner does not leave one. Good intentions do not close that gap.
Detection that does not need your name
If disclosure cannot reach you, detection has to start in your own environment.
Know what you had
An inventory of your non-human identities tells you which credentials lived in those pipelines on March 24, what each one reaches, and who owns it. Without that list, "were we exposed" has no answer.
Know what sits on the endpoint
The payload ran at Python interpreter startup, on developer laptops as readily as on CI runners. It never touched a repository. Developer Endpoint Protection extends secrets detection to the machines where code actually executes, which is where this campaign collected everything it collected.
Know what is still live
Continuous secrets detection with automated validity checking turns "we might be in there somewhere" into a ranked list of credentials to rotate today.
Know when someone uses them
This stealer collected environment variables and .env files, which is where honeytokens sit. The first time an attacker tries one, you get an alert. That signal reaches you without anyone having to identify you first, which is the gap this archive exposes.
