A new analysis by threat intelligence firm CloudSEK suggests the brief compromise of the popular LiteLLM Python package on PyPI may have exposed credentials from more than 2,500 organizations worldwide.[10] CloudSEK said it reviewed a cache of roughly 434,000 files stolen by the attackers during the March supply-chain attack and used the material to map potential victims across cloud, SaaS, and enterprise environments.[10]
On 24 March 2026, attackers controlling LiteLLM’s PyPI publish token pushed two backdoored releases, versions 1.82.7 and 1.82.8, that were briefly available for download before PyPI quarantined the project.[1][9][14] LiteLLM’s own incident report says the malicious packages were live from 10:39 UTC for about 40 minutes, but urges users to treat any installation that day up to 16:00 UTC as potentially compromised.[1][10] Security analyses by multiple vendors found that the trojanized builds harvested environment variables, SSH keys, cloud provider credentials, Kubernetes tokens, and database passwords before encrypting and exfiltrating them to an attacker-controlled domain, models.litellm.cloud, that is not part of the legitimate project infrastructure.[1][6][10]
Researchers who decompiled the malware note that the malicious LiteLLM wheels included a specially crafted .pth file that executed automatically whenever Python started, giving the attacker code a stealthy foothold on any host where the package was present.[12][15] According to incident reconstructions by Datadog, Cycode, and others, the attackers, a group dubbing itself TeamPCP, first compromised a GitHub Action used by Aqua Security’s Trivy scanner, then abused the exposed LiteLLM PyPI API token to publish the poisoned releases under the project’s name.[6][9][14] The Trivy-linked supply-chain campaign has also been tied to a malicious PyPI release of the Telnyx library, illustrating how one compromised pipeline can cascade into multiple ecosystems.[9][10]
The LiteLLM supply-chain incident has been assigned identifier CVE-2026-33634 with a CVSS v3 score of 9.4, reflecting its potential to give attackers direct access to sensitive secrets used across AI and cloud infrastructure.[5] Safeguard and other researchers note that CISA has added CVE-2026-33634 to its Known Exploited Vulnerabilities catalog, signaling evidence of exploitation in real-world environments and raising the pressure on organizations to remediate.[5] LiteLLM has also faced scrutiny over several distinct high-severity flaws in its gateway component, including a pre-authentication SQL injection tracked as CVE-2026-42208 that can be chained to remote code execution, and an authentication bypass issue cataloged as CVE-2026-49468, though these bugs are separate from the PyPI backdoor.[3][4][11]
For organizations that pulled LiteLLM 1.82.7 or 1.82.8 into development, CI/CD, or production environments, defenders must assume that any credentials, tokens, or SSH keys accessible from those systems may already be in attacker hands.[1][6][14] Vendor advisories recommend uninstalling the malicious versions, upgrading to a known-good release, rotating all potentially exposed secrets, and reviewing logs for outbound connections to the models.litellm.cloud domain and other indicators associated with the TeamPCP infrastructure.[1][6][7][10] Security teams are further urged to scan source repositories and build pipelines for cached wheels or pinned dependencies referencing the compromised versions, since Python package caches and container images can silently reintroduce the backdoor long after PyPI has removed it.[7][8][12]
The LiteLLM compromise adds to a growing list of software supply-chain attacks exploiting trust in open-source ecosystems, echoing previous incidents such as dependency confusion campaigns and recent package-manager hijacks.[6][8][14] Analysts warn that organizations relying heavily on AI gateways and other orchestration layers should treat them as high-value assets, subject to the same hardening, code review, and runtime monitoring already reserved for core identity and network control planes.[3][6][13]
References
- Security Update: Suspected Supply Chain Incident
- RCE in LiteLLM (CVE-2026-42208): How Two …
- CVE-2026-49468 – Red Hat Customer Portal
- LiteLLM Backdoor: When the Scanner Poisons the Pipeline
- Your AI Gateway Was a Backdoor: Inside the LiteLLM Supply Chain Compromise
- LiteLLM PyPI Supply Chain Attack: What Happened & How …
- Major Security Event: Supply Chain Compromise in LiteLLM Versions 1.82.7 and 1.82.8 | Bitsight
- LiteLLM and Telnyx compromised on PyPI
- Malicious LiteLLM Releases Tied to Trivy Hack May Have …
- CVE-2026-49468: Litellm Auth Bypass Vulnerability
- litellm 1.82.8 Supply Chain Attack on PyPI (March 2026)
- Breaking LiteLLM: From Low-Privilege User to Admin and RCE …
- LiteLLM Supply Chain Attack: What Happened and How to …
- LiteLLM Hack: Were You One of the 47,000? – FutureSearch
