Malicious LiteLLM releases exposed secrets in PyPI supply-chain attack

Two malicious LiteLLM releases were available on PyPI for about 40 minutes in March and included code designed to steal environment variables, SSH keys, cloud credentials, Kubernetes tokens, database passwords, and model API keys. LiteLLM identified versions 1.82.7 and 1.82.8 as compromised and said users should treat installs on March 24 from 10:39 to 16:00 UTC as suspect.

CloudSEK says a dataset built from roughly 434,000 captured files and logs maps potential exposure to more than 2,500 organizations, though the company stressed the figures are not a confirmed victim count. The public lookup labels entries by confidence, using CI runner identity signals, host details, committer domains, and repository namespaces to assess likely ownership.

The incident is tied to the wider TeamPCP supply-chain campaign involving Aqua Security’s Trivy scanner, tracked by Google as UNC6780 and by CVE-2026-33634. The FBI warned that stolen credentials could be used long after the initial compromise, and organizations are being urged to check for affected LiteLLM installs, rotate exposed secrets, and search GitHub repositories for TeamPCP indicators such as tpcp-docs or docs-tpcp.