- Published on
Malicious LiteLLM Releases Tied to Trivy Hack May Have Exposed 2,100+ Organizations
- Authors
- Name
- DeepHorus
CloudSEK warns that two malicious LiteLLM releases on PyPI, live for only 40 minutes in March, may have exposed more than 2,100 organizations to credential theft. The threat intelligence firm's dataset, built from roughly 434,000 files captured by the attackers, maps potential exposure to over 2,500 entities. However, CloudSEK stresses this is not a victim count, but an assessment based on captured files.
LiteLLM is a popular open-source AI gateway used to connect applications with multiple model providers. The compromised versions, 1.82.7 and 1.82.8, were uploaded on March 24 and remained available for about 40 minutes before PyPI quarantined them. The incident is linked to the TeamPCP supply-chain campaign, which also targeted Aqua Security's Trivy scanner earlier that month.
The dataset is available as a public lookup, searchable by name or domain and filterable by confidence. High-confidence matches rely on identity signals in the captured CI runner environment, such as host identity and legitimate committer domains. Entries include NVIDIA, Cisco, Deloitte, Volkswagen, FedEx, Siemens, and X Corp. Yet none of that confirms stolen credentials were used, so both CloudSEK and LiteLLM advise rotating secrets immediately.
The malicious code hid in a file named litellm_init.pth, which Python executes at interpreter startup. This meant the payload ran whenever any Python process started in the compromised environment, regardless of whether LiteLLM was imported. The code harvested environment variables, SSH keys, cloud credentials, Kubernetes tokens, and database passwords before encrypting and sending them to an attacker-controlled domain, models.litellm[.]cloud.
Organizations using LiteLLM, even via transitive dependencies, are at risk. A project advisory notes that an unpinned transitive dependency could deliver the malicious package without anyone explicitly choosing it. Since long-lived secrets copied during the exposure window remain usable unless rotated, the potential for abuse persists. The FBI's July advisory warns that affiliated actors may weaponize exfiltrated credentials long after the initial compromise.
The FBI advisory, FLASH-20260702-01, instructs organizations to rotate CI/CD secrets, publishing tokens, and cloud credentials accessible during the exposure windows. Aqua Security, which was also a victim of the broader TeamPCP campaign, said attackers retained access after incomplete credential rotation and force-pushed malicious commits to trivy-action. Google tracks the group as UNC6780.
Moving forward, security teams should shift to temporary credentials and monitor for unusual activity. The LiteLLM incident underscores the importance of vetting open-source dependencies and pinning versions. CloudSEK and LiteLLM both emphasize rotating credentials now, rather than waiting for proof of misuse.
This attack is part of a wider trend of supply-chain compromises targeting developer trust. The TeamPCP campaign shows how attackers can leverage incomplete remediation and spread malicious code across popular tools. As AI infrastructure grows, gateways like LiteLLM become prime targets, making robust security practices essential.
