Compromised LiteLLM releases exposed developer secrets

LiteLLM, a Python library that provides a unified API wrapper for LLM providers including OpenAI, Anthropic and Azure, became the center of a software supply chain attack in March 2026. Attackers gained access to the maintainer’s PyPI account and published malicious releases, 1.82.7 and 1.82.8, which could be pulled through standard installs or as transitive dependencies.

FutureSearch engineers discovered the compromise while testing a Cursor MCP plugin that depended on LiteLLM. After Python started, their machine became unresponsive from RAM exhaustion, leading them to a litellm_init.pth file described as a 34,628-byte, double base64-encoded payload in site-packages/. The malware ran in stages to collect environment variables, cloud credentials, Kubernetes configs, SSH keys, Docker configs, CI/CD secrets, database credentials and crypto wallets, then exfiltrated the data to attacker-controlled infrastructure.

The malicious versions were live for about two hours, but the risk was amplified by LiteLLM’s use in AI apps, backend services, CI/CD pipelines and cloud infrastructure. The incident was also tied to a broader campaign linked to the TeamPCP group and a previous breach involving Trivy and other tools.

Users were advised to remove affected versions, upgrade to a known clean release, rotate API keys, cloud credentials, SSH keys and CI/CD tokens, audit logs and outbound traffic, check for the litellm_init.pth file, and rebuild high-risk environments from a clean state. Longer-term mitigations include dependency pinning, scanning, signature verification and SBOM tracking.