Compromised LiteLLM Packages: More Than 2,500 Organizations Affected

Compromised LiteLLM versions uploaded to PyPI stole credentials and access tokens. CloudSEK has identified more than 2,500 potentially affected organizations linked to the TeamPCP campaign.

Compromised LiteLLM Packages Exposed Credentials

Two compromised versions of the open source software LiteLLM, versions 1.82.7 and 1.82.8, were published to the Python Package Index (PyPI) in late March 2026. LiteLLM serves as an AI gateway for connecting applications to different large language models. The malicious packages remained available for around 40 minutes before PyPI quarantined them.

The attack relied on a file named litellm_init.pth, which caused the malicious code to execute automatically whenever a Python process was started. This happened regardless of whether the LiteLLM library was explicitly imported by the respective script.

The malware specifically harvested environment variables, including API keys for language models such as OPENAI_API_KEY and ANTHROPIC_API_KEY, as well as SSH keys, Kubernetes tokens, cloud credentials and database passwords. The stolen data was then encrypted and transmitted to the attacker controlled domain models.litellm[.]cloud.

Scale of TeamPCP Campaign and LiteLLM Attribution

Security company CloudSEK analyzed a dataset containing around 434,000 intercepted log and exfiltrated files. The researchers linked the data to more than 2,500 organizations, including NVIDIA, Cisco, Deloitte, Volkswagen, FedEx and Siemens. The attribution was based on identity signals found in CI/CD pipelines, including host IDs and developer domains.

The incident is part of a broader supply chain campaign conducted by the TeamPCP threat group, which Google tracks as UNC6780. The activity is tracked under CVE-2026-33634. As part of the same campaign, releases of the security software Trivy were also compromised.

The FBI warned in a security advisory that stolen credentials can remain useful to attackers long after the initial breach and may be abused at a later stage.

Confirmed Impact and Recommended Security Measures

Several affected organizations have confirmed tangible consequences of the attack. At Checkmarx, the stolen credentials resulted in unauthorized access to GitHub repositories. CERT-EU also found that the Trivy supply chain compromise resulted in approximately 91.7 GB of compressed data being exfiltrated from an AWS account belonging to the European Commission.

Security experts and law enforcement agencies recommend that affected teams take the following steps:

• Check systems for installations of LiteLLM versions 1.82.7 or 1.82.8 during the relevant window on March 24, 2026, from 10:39 to 16:00 UTC.
• Rotate all credentials, API keys, SSH keys and publishing tokens that were accessible from affected systems.
• Search internal GitHub organizations for suspicious repositories using naming prefixes such as tpcp-docs or docs-tpcp, which the malware created to facilitate data exfiltration.

(Editorial Team)