Log in Request a demo

Significant cyber incident

LiteLLM PyPI package compromise

In short

On 24 March 2026, two malicious versions of LiteLLM (1.82.7 and 1.82.8), a widely used AI gateway package, were published to PyPI with a credential stealer that looked for SSH keys, cloud credentials and Kubernetes tokens. Anyone who installed an unpinned copy during the window had to treat their secrets as stolen. LiteLLM believes a compromised Trivy scanner was the entry point, but this is not confirmed.

Last updated 9 October 2026

What happened

On 24 March 2026, LiteLLM versions 1.82.7 and 1.82.8 appeared on PyPI. LiteLLM says they were not released through its normal build process. They contained code that steals credentials.

The packages were live from 10:39 UTC. LiteLLM says they were up for about 40 minutes, but the same post also defines the affected window as 10:39 to 16:00 UTC. PyPI reports a total exposure of 2 hours 32 minutes. Sources differ.

LiteLLM and PyPI both say the attacker got a publishing token after an exploited Trivy dependency. LiteLLM describes this as its belief, and its investigation was still marked active when last updated. A clean version, 1.83.0, followed on 30 March 2026.

Timeline

  1. 24 March 2026, 10:39 UTC

    LiteLLM says the malicious versions 1.82.7 and 1.82.8 went live on PyPI

  2. 24 March 2026

    A user opens a public GitHub issue reporting a malicious litellm_init.pth in 1.82.8

  3. 24 March 2026, 15:35 UTC

    The PyPA advisory record PYSEC-2026-2 is last modified at this time

  4. 24 March 2026

    LiteLLM publishes its security update; PyPI quarantines the packages (LiteLLM: about 40 minutes live; PyPI: 2h 32m total exposure)

  5. 24 March 2026

    LiteLLM says the affected install window ends at 16:00 UTC

  6. 25 March 2026

    GitHub publishes advisory GHSA-5mg7-485q-xm76, rated critical, with no CVE

  7. 26 March 2026

    CISA adds the Trivy embedded malicious code flaw (CVE-2026-33634) to its KEV Catalog

  8. 27 March 2026

    LiteLLM adds SHA-256 checksums for audited clean releases

  9. 30 March 2026

    LiteLLM releases clean version 1.83.0 from a new CI/CD pipeline

  10. 1 April 2026

    CERT-EU's March Cyber Brief names TeamPCP as the actor behind the LiteLLM compromise

  11. 2 April 2026

    PyPI publishes its incident report on LiteLLM and telnyx

  12. 22 July 2026

    PyPI announces it rejects new files on releases older than 14 days

How the attack worked

Getting in

PyPI and the GitHub advisory say a publishing token was exposed through an exploited Trivy dependency. PyPI later said both projects were hit because of a mutable reference in their use of the Trivy GitHub Action. LiteLLM says it believes the compromise began with Trivy in its CI/CD security scanning. It also says the attacker bypassed its official workflows and uploaded straight to PyPI. This link to Trivy is LiteLLM’s belief and is not confirmed.

Supply Chain Compromise: Compromise Software Supply Chain (T1195.002) is the technique CERT-EU lists for the connected Trivy compromise.

Two different payloads

Version 1.82.7 hid a malicious payload in proxy_server.py. Version 1.82.8 did that and also added a file called litellm_init.pth. The PyPA advisory says the code runs when any module of the package is imported. A public issue reporter said the .pth file runs on any Python start and that 1.82.7 looked clean to them. LiteLLM says both versions were affected, so sources differ on 1.82.7.

What it stole

The code looked for environment variables, SSH keys, cloud provider credentials, Kubernetes tokens and database passwords. The PyPA advisory adds Git and Docker credentials, dotenv files, LDAP configuration, shell history and cryptowallet keys. It also tried to get cloud tokens from metadata servers and secrets from AWS Secrets Manager.

Sending and staying

Data was encrypted and sent by POST to models.litellm[.]cloud, which is not a LiteLLM domain. The advisory describes a systemd service named “System Telemetry Service” for persistence, and a new pod in Kubernetes. The persistence script contacts a second attacker domain, listed in the advisory, for further instructions.

Impact

LiteLLM: versions 1.82.7 and 1.82.8 on PyPI were affected. Official Docker proxy image users, LiteLLM Cloud users and users on 1.82.6 or earlier who did not upgrade in the window were not affected, per LiteLLM.
PyPI: the exploited versions were downloaded over 119k times. PyPI also estimates roughly 40-50% of LiteLLM installs were unpinned.
CERT-EU: approximately 500,000 devices were reportedly affected globally. This is a reported figure, and sources differ on scale.
Exposure time: LiteLLM says about 40 minutes (and also gives 10:39 to 16:00 UTC as the affected window). PyPI says 2h 32m. Sources differ.
No source opened gives named victims of stolen credentials beyond this. The advisory says anyone who installed and ran the package should assume credentials may be exposed.

Government and regulator response

  • 24 March 2026, LiteLLM: removed the packages from PyPI, rotated maintainer credentials, named new maintainers and engaged an outside forensic firm. It paused all new releases.
  • 24-25 March 2026, GitHub and PyPA: PYSEC-2026-2 and advisory GHSA-5mg7-485q-xm76 (critical, no CVE) were published.
  • 26 March 2026, CISA: added the Trivy embedded malicious code flaw (CVE-2026-33634) to the KEV Catalog.
  • 27-30 March 2026, LiteLLM: published checksums for audited clean releases, released clean 1.83.0 from a new CI/CD pipeline, and began signing Docker images with cosign.
  • 2 April 2026, PyPI: published an incident report and worked with the maintainers on token rotation and Trusted Publishers. It recommends dependency cooldowns and lock files.
  • 22 July 2026, PyPI: now rejects new files on releases older than 14 days. PyPI says the discussion restarted after this incident.
  • 8 June 2026, CISA: added CVE-2026-42271, a LiteLLM command injection flaw, to KEV. This is a separate software flaw, not the supply chain compromise. The GitHub advisory for this incident states there is no CVE.

Lessons

  1. Unpinned installs spread bad releases fast

    PyPI estimates roughly 40-50% of LiteLLM installs fetched the latest version each time, so a bad release reached many systems before it was caught.

  2. Build tools can be the way in

    LiteLLM believes a compromised security scanner in its pipeline led to the break-in. A tool meant to protect the build had access to a publishing token.

  3. Long-lived tokens are a risk

    PyPI says API tokens can be used later even if the first compromise goes unnoticed, and recommends Trusted Publishers with short-lived tokens.

  4. Pin references to exact versions

    PyPI links the compromise to a mutable reference in the Trivy GitHub Action. CERT-EU advises pinning GitHub Actions to full SHA hashes.

  5. Official numbers can differ

    LiteLLM says about 40 minutes, PyPI says 2h 32m. Check every system that installed in a wide window, not a narrow one.

  6. Treat a run as full exposure

    The advisory says anyone who installed and ran the package should assume credentials in that environment may be exposed and rotate them.

What to check in your own organization

  1. Find the versions

    Search laptops, servers, containers and CI logs for litellm 1.82.7 or 1.82.8, including indirect installs pulled in by other AI tools.

  2. Look for the file

    Check site-packages for litellm_init.pth and for a systemd service called "System Telemetry Service".

  3. Check network logs

    Search for traffic to the attacker domains listed in the LiteLLM and PyPA advisories on 24 March 2026 and after.

  4. Rotate secrets

    If either version ran, rotate SSH keys, cloud keys, Kubernetes tokens, database passwords and anything in environment variables.

  5. Pin and lock

    Use lock files with hashes, and consider a cooldown before taking brand new releases, as PyPI recommends.

  6. Review your pipeline

    Pin GitHub Actions to full SHA hashes, and replace long-lived publishing tokens with Trusted Publishers where possible.

  7. Early warning

    Threat intelligence monitoring could watch for exposed credentials tied to your company, alerts about compromised packages you depend on, and reports naming groups like TeamPCP. Any of these might have prompted an earlier secret rotation or install freeze. This is not a promise of detection.

Questions

Which LiteLLM versions were malicious?

Versions 1.82.7 and 1.82.8 on PyPI, per LiteLLM, the GitHub advisory and PyPI. One public issue reporter said 1.82.7 looked clean, so sources differ on that version.

How long were they online?

Sources differ. LiteLLM says about 40 minutes and also gives a window of 10:39 to 16:00 UTC. PyPI reports 2h 32m from upload to quarantine.

Was the official Docker image affected?

LiteLLM says customers running the official LiteLLM Proxy Docker image were not impacted, because it pins its dependencies.

Was Trivy really the cause?

LiteLLM says it believes so. PyPI and the GitHub advisory also describe an API token exposed through an exploited Trivy dependency. LiteLLM presents its own link as a belief, not a confirmed finding.

Who did it?

CERT-EU attributes the LiteLLM compromise to the cybercrime actor TeamPCP, using the word "reportedly". LiteLLM's own post names no actor.

Is there a CVE for this incident?

No. The GitHub advisory says no known CVE. CISA's June 2026 LiteLLM KEV entry (CVE-2026-42271) is a separate command injection flaw.

In our research

  1. How a Trivy Compromise Reached LiteLLM Releases October 2026
  2. TeamPCP Threat group

Sources

  1. Security Update: Suspected Supply Chain Incident LiteLLM (BerriAI)
  2. Two LiteLLM versions published containing credential harvesting malware (GHSA-5mg7-485q-xm76) GitHub Advisory Database
  3. PYSEC-2026-2 litellm advisory Python Packaging Authority advisory database
  4. Incident Report: LiteLLM/Telnyx supply-chain attacks, with guidance The Python Package Index Blog (PSF)
  5. Releases now reject new files after 14 days The Python Package Index Blog (PSF)
  6. SECURITY: litellm 1.82.8 on PyPI contains malicious credential-stealing payload (litellm_init.pth), Issue #24521 BerriAI/litellm on GitHub
  7. Cyber Brief 26-04 - March 2026 CERT-EU
  8. European Commission cloud breach: a supply-chain compromise CERT-EU
  9. CISA Adds One Known Exploited Vulnerability to Catalog (26 March 2026) CISA
  10. CISA Adds Two Known Exploited Vulnerabilities to Catalog (8 June 2026) CISA

Browse the threat library

Keep exploring

Knowledge Hub

Glossary term

Supply chain attack

A supply chain attack reaches its target by exploiting weaknesses in the products or services the target depends on.

Read more

Incident

Trivy scanner and GitHub Actions compromise

In March 2026 an attacker used stolen credentials to publish a malicious version of the Trivy security scanner and to replace the tags of two of its GitHub Actions with credential-stealing code.

Read more

Glossary term

Persistence

Persistence is the set of actions an attacker takes to keep access to a system after the first break-in.

Read more