By ByteBot
Five months after malicious LiteLLM packages spent 40 minutes on PyPI, the damage is now fully visible. Researchers published a 153GB archive today containing 118,829 CI runner environment dumps from 2,488 organizations — AWS, NVIDIA, Samsung, Cisco, Salesforce, Deloitte, Volkswagen, and more. If your team installed LiteLLM versions 1.82.7 or 1.82.8 in late March 2026, those credentials are publicly available right now.
How 40 Minutes on PyPI Broke 2,488 Companies
The attack didn’t start with LiteLLM. It started with Trivy.
On March 19, threat actor TeamPCP compromised Trivy v0.69.4 — Aqua Security’s widely-used vulnerability scanner — by exploiting credentials from a prior, incompletely-remediated incident. The poisoned Trivy appeared functionally normal: scans returned valid results while silently harvesting environment variables, cloud tokens, and SSH keys from every CI runner that executed it.
LiteLLM’s own CI/CD pipeline installed Trivy via an unpinned dependency command. That’s the fatal flaw. The compromised scanner ran inside LiteLLM’s build environment with legitimate read access, exfiltrating the project’s PyPI publishing credentials. Five days later, on March 24, TeamPCP used those stolen tokens to publish two malicious LiteLLM releases directly to PyPI. They were live for approximately 40 minutes before quarantine.
Forty minutes. In that window, 97 million monthly downloads worth of install automation pulled from compromised packages across 434,000 CI/CD pipelines. The attack is documented under CVE-2026-33634 with a CVSS score of 9.4.
Check If You Were Hit
Run this first:
pip show litellm | grep VersionIf output shows 1.82.7 or 1.82.8, treat the machine as compromised. Version 1.82.8 is the more dangerous variant. It includes a file named litellm_init.pth placed in the site-packages directory. Python executes .pth files automatically on interpreter startup — no import required, no user action needed. Any Python process on the affected machine was potentially a credential exfiltration event.
Check for persistence indicators:
ls ~/.config/sysmon/sysmon.py 2>/dev/null && echo "COMPROMISED"
find $(python -c "import site; print(site.getsitepackages()[0])") -name "litellm_init.pth"Additional indicators: outbound HTTPS connections to models.litellm[.]cloud or checkmarx[.]zone, and abnormal RAM consumption or machine freezing on Python calls. The .pth file spawns a child process on every interpreter start — on heavily-automated systems, this creates an exponential fork loop that visibly degrades performance.
If you find anything: uninstall immediately and purge the package cache to prevent reinstallation from a locally cached wheel.
pip uninstall litellm -y && pip cache purge
# uv users:
rm -rf ~/.cache/uvThen upgrade directly to 1.83.0 or the latest clean release.
What to Rotate Right Now
The malware specifically targeted AI infrastructure credentials — which is what makes this breach different from a standard credential stealer. LiteLLM is an AI gateway library; its typical deployment environment holds keys for every AI provider a team uses. TeamPCP extracted all of it.
Rotate everything that was present on any affected machine or CI runner:
- AWS IAM access keys and secret keys
- GitHub and GitLab personal access tokens
- Azure app registration secrets and managed identity tokens
- Kubernetes service account tokens
- SSH keys (generate new pairs, update all
authorized_keys) - OpenAI, Anthropic, and Azure AI API keys
- Slack OAuth tokens
- Database passwords in any .env files present during CI runs
This is not optional. In July 2026, the FBI issued a FLASH advisory explicitly warning that credentials stolen in this attack remained active and weaponizable. That was before today’s 153GB dump became publicly accessible. The threat actor pool is now anyone who downloads the archive — not just the original attackers.
What Should Have Stopped This
Two things failed simultaneously, and both were avoidable.
First, LiteLLM’s CI pipeline installed Trivy via an unpinned version command. Pinning to a specific hash — not a version tag, since tags are mutable — would have kept compromised Trivy v0.69.4 out of the build. Security tools deserve the same dependency discipline as production code. Using a security scanner with unpinned dependencies is a contradiction in terms.
Second, the pipeline held long-lived PyPI publishing credentials. An attacker who can read the CI environment can steal and use them immediately. The fix: use PyPI’s Trusted Publisher configuration with GitHub Actions OIDC token exchange. No stored secrets, no stealable credentials — just a short-lived token generated per-publish that expires after the run.
GitHub and PyPI responded in July with structural fixes: a default 3-day Dependabot cooldown before version updates are proposed, and a 14-day window during which PyPI rejects new files added to old release versions. Both changes were accelerated by this incident. They matter — but they won’t help the 2,488 organizations whose credentials are already public. We covered the Dependabot cooldown in detail when it shipped.
The larger lesson isn’t about LiteLLM specifically — it’s about the AI toolchain as an attack surface. Libraries that abstract access to multiple AI providers are credential aggregators by design. When one falls, it doesn’t expose one set of keys. It exposes every set. Supply chain attacks targeting AI infrastructure are now a first-class threat model. Build accordingly.
