# Malicious LiteLLM PyPI Releases Steal Cloud Credentials via TeamPCP

> Malicious LiteLLM PyPI releases 1.82.7 and 1.82.8 exfiltrated cloud keys, SSH keys, and tokens from 2,100+ organizations in the TeamPCP supply chain campaign.

- Published: 2026-08-12T09:02:31.000Z
- Severity: critical
- Category: Supply Chain
- Tags: LiteLLM, PyPI, Supply Chain Attack, TeamPCP, Credential Theft
- CVEs: CVE-2026-33634
- Author: Runtime Rebel Intel
- Primary source: https://thehackernews.com/2026/08/malicious-litellm-releases-tied-to.html
- Canonical: https://runtimerebel.com/blog/malicious-litellm-pypi-releases-steal-cloud-credentials-via-teampcp

## Key points

- Malicious LiteLLM packages stole cloud keys, SSH keys, and other secrets from potentially 2,100+ organizations.
- LiteLLM versions 1.82.7 and 1.82.8, installed on March 24, 2026, within environments tied to the TeamPCP campaign, are affected.
- Immediately rotate all CI/CD, cloud, and publishing credentials exposed during the compromise window.

Two malicious versions of the LiteLLM open-source [AI](/glossary#ai) gateway, 1.82.7 and 1.82.8, were briefly available on PyPI in March 2026, containing credential-stealing code. These **malicious LiteLLM releases** are linked to the broader TeamPCP supply-chain campaign (tracked by Google as UNC6780) and may have exposed sensitive data from more than 2,100 organizations. The compromise highlights the persistent risks within the software supply chain, particularly for widely used package repositories like PyPI.

## Technical Details and Campaign Overview

On March 24, 2026, between approximately 10:39 UTC and 16:00 UTC, the compromised LiteLLM versions 1.82.7 and 1.82.8 were present on PyPI. Users who installed these packages during this window are advised to consider their systems potentially compromised. The malicious packages specifically included a file named `litellm_init.pth`, which Python processes automatically at interpreter startup. This mechanism ensured that the credential-stealing [payload](/glossary#payload) executed whenever any Python process started in the compromised environment, regardless of whether LiteLLM was explicitly imported.

The payload was designed to exfiltrate a wide array of sensitive data, including: 

*   Environment variables (such as `OPENAI_API_KEY`, `ANTHROPIC_API_KEY`)
*   [SSH](/glossary#secure-shell-ssh) keys
*   Cloud credentials
*   Kubernetes tokens
*   Database passwords

Stolen data was encrypted and sent to `models.litellm[.]cloud`, an attacker-controlled domain distinct from the legitimate LiteLLM project. The FBI, in its FLASH-20260702-01 advisory, warned that actors affiliated with the TeamPCP campaign are likely to weaponize these exfiltrated credentials long after the initial compromise.

### Connection to the TeamPCP Supply Chain Campaign

The incident with LiteLLM is part of a larger [supply chain attack](/glossary#supply-chain-attack) orchestrated by the group known as TeamPCP. This campaign is also linked to a compromise affecting Aqua Security's Trivy scanner. The overarching ecosystem compromise is tracked as [CVE-2026-33634](/cve/cve-2026-33634), which was added to [CISA](/glossary#cybersecurity-and-infrastructure-security-agency-cisa)'s Known Exploited Vulnerabilities catalog on March 26. This [CVE](/glossary#cve) now explicitly lists BerriAI LiteLLM versions 1.82.7 and 1.82.8 as affected, alongside Trivy components.

While the exact method by which the **malicious LiteLLM releases** reached PyPI was initially debated, analyses from CloudSEK, LiteLLM's incident report, and Unit 42 indicate a common root: an [API](/glossary#api) token exposed through the compromised Trivy dependency was subsequently used to upload the two malicious LiteLLM versions to PyPI. CloudSEK clarified to [The Hacker News](https://thehackernews.com/2026/08/malicious-litellm-releases-tied-to.html) that these represent different stages of the same attack chain, where the credential exposure from the Trivy compromise facilitated the subsequent PyPI upload.

## Assessing the Impact and Who Is Affected

[Threat intelligence](/glossary#threat-intelligence) firm CloudSEK reported obtaining a dataset of approximately 434,000 captured files and exfiltration events, which it assessed as belonging to the campaign. Based on this data, CloudSEK maps potential exposure to over 2,100 organizations. It is important to note that this figure represents potential exposure, not confirmed victims or instances of credential misuse. Prominent entities such as NVIDIA, Cisco, Deloitte, Volkswagen, FedEx, Siemens, and X Corp are among those whose systems appear in the captured dataset. However, their inclusion does not confirm that stolen credentials were used, only that files from their environments were exfiltrated.

The danger extends beyond direct LiteLLM users. The project's advisory points out that an unpinned transitive dependency, pulled in by an agent framework or orchestration tool, could inadvertently introduce the malicious LiteLLM package into an environment without explicit installation. This highlights the pervasive risk of supply chain compromises.

## Actionable Recommendations: Mitigating TeamPCP Credential Exposure

To address the risks posed by these malicious packages and the wider TeamPCP campaign, security professionals should prioritize the following actions:

*   **Credential Rotation**: Immediately **rotate [CI/CD](/glossary#ci-cd) secrets after LiteLLM compromise**, along with any publishing tokens, cloud credentials, SSH keys, Kubernetes tokens, and database passwords that were accessible during the compromise window (March 24, 2026, up to 16:00 UTC).
*   **Assume Compromise**: Treat any installation of LiteLLM on March 24, 2026, as suspect and review associated environments for signs of compromise or [data exfiltration](/glossary#data-exfiltration).
*   **Transition from Long-Lived Tokens**: Move away from static, long-lived access tokens and keys. Implement ephemeral or temporary credentials wherever possible to reduce the window of opportunity for attackers should a token be compromised.
*   **Software Supply Chain Hygiene**: Regularly audit and secure CI/CD pipelines, publishing mechanisms, and software dependencies. Ensure that all dependencies are pinned to specific, trusted versions to prevent the accidental introduction of malicious packages via transitive dependencies.
*   **Monitor for Anomalies**: Continuously monitor network traffic and system logs for unusual outbound connections to unknown domains (like `models.litellm[.]cloud`) or suspicious access patterns to sensitive resources. This is essential for effective **TeamPCP supply-chain campaign mitigation**.

**Related:** [Anthropic Claude AI Incident: PyPI Malware & Supply Chain Risks](/blog/anthropic-claude-ai-incident-pypi-malware-supply-chain-risks), [Shai-Hulud Campaign: TeamPCP Targets Open-Source Supply Chain](/blog/shai-hulud-campaign-teampcp-targets-open-source-supply-chain)

---

AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/malicious-litellm-pypi-releases-steal-cloud-credentials-via-teampcp