Researchers Map LiteLLM Supply-Chain Exposure Across 2,488 Corporate Domains

Researchers examining data from the March 2026 LiteLLM supply-chain attack say a 153GB archive contains 433,909 files, including 118,829 CI runner dumps attributed to 2,488 corporate domains. A parallel reconstruction estimates that more than 2,500 organizations and 434,000 CI/CD pipelines were potentially exposed, but investigators caution that a dataset match is not proof of successful compromise or credential theft.