A 153 gigabyte archive is still coughing up live credentials from more than 2,000 companies, five months after hackers hijacked LiteLLM's PyPI publishing keys using a poisoned security scanner.
Here's the part that should worry you most if you run LiteLLM in production: this didn't start with LiteLLM at all. It started with Trivy, the open source vulnerability scanner half the industry uses to check its own containers for problems. A threat cluster tracked as TeamPCP exploited an incomplete credential rotation at Aqua Security, the company behind Trivy. On March 19, 2026, it force-pushed malicious commits into 76 of 77 trivy-action version tags and all seven setup-trivy tags, according to research published by the Cloud Security Alliance. From there the attackers cascaded into Checkmarx KICS on March 23, then into LiteLLM on March 24. One scanner's bad key rotation turned into a three-project breach chain in five days.
LiteLLM is the connective tissue a huge share of the AI industry runs on. It's an open source gateway that lets a company route calls to OpenAI, Anthropic, Google, and more than a hundred other providers through one interface, so a team can swap models without rewriting its whole stack. That ubiquity is exactly why it made such a good target. The package pulls over 3.4 million downloads a day, and more than 95 million in the trailing month, according to reporting from BleepingComputer.
Using the stolen Trivy pipeline access, TeamPCP got hold of LiteLLM's own PyPI publishing tokens and pushed two trojanized releases, version 1.82.7 and 1.82.8, live on March 24. They stayed up for roughly five and a half hours, from 10:39 to 16:00 UTC, before maintainers pulled them. That's a narrow window, but LiteLLM's install base meant it was more than enough. The payload was ugly by design. It weaponized Python's .pth file mechanism, a packaging quirk that runs arbitrary code on every single interpreter startup, whether or not anyone actually imports the LiteLLM package in their script. Once resident, it harvested environment variables, SSH keys, Kubernetes secrets, database passwords, and AI provider API keys, then shipped them to attacker-controlled infrastructure, according to a technical writeup from Help Net Security.
Two Perth men charged over TeamPCP hack that hit OpenAI and GitHub Australian Federal Police and the FBI arrested Ruben Thomson, 21, and Louis Gaebler, 23, from Perth, charging them with 14 offences over TeamPCP, the group accused of poisoning Trivy, Checkmarx KICS and LiteLLM to steal 500,000 credentials from OpenAI, GitHub, SAP and over 1,000 other organizations. - how to detect CI/CD pipeline supply chain attacks - TeamPCP hacker arrested for stealing OpenAI GitHub credentials
BleepingComputer reported the attackers logged roughly 500,000 data exfiltration events, though many of those are duplicates from the same machines phoning home repeatedly rather than half a million distinct victims. Still, the scale is real. CloudSEK is the threat intelligence firm that first reconstructed the stolen archive. It says it recovered 433,909 files pulled from 2,488 organizations, and the list of names is not small-time: Nvidia, AWS, Cisco, Samsung, and Siemens all appear in it, per CloudSEK's own research and corroborating coverage from Heise.
That reconstructed dataset is what turned this from a March story into an August one. Researchers who got access to the 153GB archive found that five months after the initial breach, many of the credentials inside it were still valid. Nobody had rotated them.
That gap mattered enough that the FBI stepped in. A July 2 advisory warned that actors affiliated with the campaign are likely to keep weaponizing the exfiltrated credentials long after the original compromise. It told organizations to rotate CI/CD secrets, publishing tokens, and cloud credentials as a baseline response, not a precaution to consider.
What to actually do if you ran LiteLLM #
If your infrastructure touched LiteLLM 1.82.7 or 1.82.8 between March 19 and 24, the guidance from the Cloud Security Alliance's research note is blunt: treat every API key, cloud credential, and CI/CD token on that host as burned, and rotate all of it. Don't wait to confirm the package was actually executed versus merely downloaded and cached. A match in the CloudSEK dataset means potential exposure, not confirmed compromise. But the cost of rotating a key you didn't need to rotate is a lot lower than the cost of leaving a live Nvidia-grade credential sitting in a leaked archive for someone else to find. This is the third AI-infrastructure supply chain story to hit in recent weeks, after the PHP vulnerability wave that took Finnish and Dutch government sites offline and the OpenCode credential-theft breach. The throughline across all three isn't a single bad actor or a single bad library. It's that the tools teams trust to secure their pipelines - a scanner, a gateway, a build runner - are themselves unaudited dependencies with privileged access. Attackers have figured out that compromising one well-placed piece of infrastructure beats phishing a thousand individual developers.
Also read: Gartner says AI infrastructure spending will outrun revenue by $4.9 trillion • Visa and Mesh Will Let Any Crypto Wallet Pay at 175 Million Stores • NextDC shares crash 37% after Melbourne grid upgrade gets blocked
This article is posted in Technology News, check it out for more related stories.
Join the discussion #
Open in the community → Almost there. Sign in and your reply posts straight away.