CloudSEK Sizes the March LiteLLM Poisoning: 434,000 Captured Files Mapped to 2,500+ Organizations

Organizations that installed LiteLLM 1.82.7 or 1.82.8 from PyPI during a roughly 40-minute window on March 24, 2026, and the CI/CD environments those installs ran in

CloudSEK released an exposure analysis on August 12, 2026 built from a dataset of roughly 434,000 files the attackers captured, mapping potential exposure to more than 2,500 organizations. NVIDIA, Cisco, Deloitte, Volkswagen, FedEx, Siemens, and X Corp appear in the lookup database. CloudSEK is explicit that these are counts of captured loot and log files, not confirmed victims: a high-confidence match required the organization's domain to appear in captured CI environment logs, and presence does not establish that credentials were used. The malware harvested environment variables including `OPENAI_API_KEY` and `ANTHROPIC_API_KEY`, plus SSH keys, cloud credentials, Kubernetes tokens, and database passwords, encrypting the results to `models.litellm[.]cloud`. Version 1.82.8 carried a 34,628-byte `litellm_init.pth` registered in the package RECORD, so the payload ran at Python interpreter startup with no import required; 1.82.7 embedded the identical stealer as a base64 blob inside `litellm/proxy/proxy_server.py`. Recommended response is to audit for either version in the window and rotate every secret those systems could reach. This is the blast-radius accounting for the March 24, 2026 TeamPCP compromise already listed below

PyPI publishing tokens stolen on March 19 through the compromised Trivy GitHub Action in LiteLLM's CI/CD pipeline, then used to upload releases directly and bypass the project's official publishing workflow. Nearly five months separated the 40-minute exposure window from a usable estimate of who was in it, which is the actual finding: the theft is fast and the accounting is slow