LiteLLM Supply Chain Attack Exposes 2,100+ Organizations via Malicious PyPI Releases
Two malicious LiteLLM releases, versions 1.82.7 and 1.82.8, were published to the Python Package Index (PyPI) on March 24 and remained available for roughly 40 minutes between 10:39 UTC and quarantine. The compromised packages contained credential-stealing code designed to harvest cloud keys, SSH keys, Kubernetes tokens, database passwords, and other secrets from any system that installed them. LiteLLM, an open-source AI gateway used to route requests across multiple large language model providers, has since removed both versions from its release history, while 1.82.6 and 1.83.0 remain available on PyPI. The project is advising users to treat any install performed that day up to 16:00 UTC as suspect and to rotate exposed credentials immediately.
Threat intelligence firm CloudSEK obtained a dataset built from approximately 434,000 files captured during the campaign and mapped potential exposure to more than 2,500 organizations. The firm clarified that the figures represent affected organizations identified within the stolen material, not confirmed victims, and that the dataset is derived from confidential intelligence sources rather than direct reconnaissance of the named entities. A public lookup, searchable by name or domain and filterable by confidence level, lists entries including NVIDIA, Cisco, Deloitte, Volkswagen, FedEx, Siemens, and X Corp, each annotated with a count of secrets exposed and labeled High or Medium. High-confidence matches rely on identity signals in the captured CI runner environment, including host identity and legitimate committer domains, while repository namespaces alone support only medium-confidence attribution.
The infection mechanism centered on a file named litellm_init.pth included in version 1.82.8. Because .pth files are processed by Python at interpreter startup, the malicious payload executed automatically whenever any Python process launched in an affected environment, whether or not LiteLLM itself was imported. This design ensured that the credential harvester ran continuously in CI runners and developer workstations, capturing secrets from any environment variable, mounted secret, or local configuration file accessible to Python. Organizations concerned about prior exposure can begin by verifying whether corporate emails appear in known collections using an email breach checker, and teams managing CI/CD pipelines should review their secret stores and audit long-lived publishing tokens.
The FBI issued an advisory on July 2, designated FLASH-20260702-01, warning that affiliated actors linked to the broader TeamPCP campaign are likely to weaponize exfiltrated credentials long after the initial compromise. The bureau specifically recommended rotating CI/CD secrets, publishing tokens, and cloud credentials accessible during the exposure window, and pointed to ephemeral, short-lived tokens as a durable defense. Security teams should run an SSL/TLS checker across exposed infrastructure to confirm certificate integrity following the incident, and individual developers are advised to test credential strength and reuse with a password checker before rotating. CloudSEK and LiteLLM both stress that absence of evidence of misuse is not evidence of absence, and that any long-lived secret copied during the window remains exploitable until actively rotated or revoked.