Malicious LiteLLM Builds May Have Affected More Than 2,100 Organizations

CloudSEK, a company specializing in cyber intelligence, has reported on the scale of the damage from the compromise of the open-source project LiteLLM — a gateway that connects applications to various language-model providers. According to the firm, the dataset it obtained of roughly 434,000 captured files points to the potential exposure of more than 2,500 organizations.

Forty minutes on PyPI

The malicious versions turned out to be 1.82.7 and 1.82.8. According to the project itself, they were available on March 24 starting at 10:39 UTC for about 40 minutes, until PyPI quarantined them; however, users are advised to treat any installation that day up to 16:00 UTC as suspicious. The Hacker News confirmed that neither version remains in the release history, whereas 1.82.6 and 1.83.0 are still available.

The code gathered environment variables, SSH keys, cloud credentials, Kubernetes tokens and database passwords, encrypted them and sent them to a domain controlled by the attackers, disguised as the project's infrastructure. Version 1.82.8 contained a file that Python executes when the interpreter starts, so the malware triggered on the launch of any Python process — even if no one had explicitly imported LiteLLM. Moreover, the package could end up in a system as an unpinned transitive dependency, pulled in, for example, by an agent framework.

Not a list of victims

CloudSEK stresses that the figures cited are not a count of those affected. The data was taken from the attackers' harvested “loot” and logs, not collected from the named companies themselves. Among those appearing in it are NVIDIA, Cisco, Deloitte, Volkswagen, FedEx, Siemens and X Corp, but being on the list does not mean the stolen keys were used. That is precisely why both CloudSEK and the LiteLLM team advise not to wait for proof, but to rotate secrets.

Part of the TeamPCP chain

The incident fits into the broader TeamPCP supply-chain attack (Google tracks the group as UNC6780), tied to the compromise of Aqua Security's Trivy scanner. The attackers retained access after an incomplete credential rotation and, on March 19, rewrote nearly all of the trivy-action tags with malicious commits. The ecosystem-wide compromise was assigned the identifier CVE-2026-33634 and was added to CISA's catalog of known exploited vulnerabilities.

There are already confirmed consequences: Checkmarx reported unauthorized access to its GitHub repositories, and CERT-EU assessed with high confidence that the attack on Trivy compromised an AWS account belonging to the European Commission, from which about 91.7 GB of compressed data was exfiltrated.

The FBI, in a July warning, noted that stolen credentials may be put to use even long after the initial compromise. Organizations are advised to check LiteLLM installations within the specified March 24 window, rotate all secrets accessible to those systems, and search their GitHub organizations for repositories showing signs of the campaign.

Source: The Hacker News