Mar 24, 2026Unverified
Compromised LiteLLM PyPI packages harvest credentials via supply-chain attack
AI loose in the worldData exfiltrationDERIVED
Approved by person, Oct 11, 2026. How entries are approved
Malicious versions of the litellm Python package (1.82.7 and 1.82.8) were published to PyPI using compromised maintainer credentials, part of the TeamPCP campaign. The payload harvested SSH keys, AWS/GCP/Azure credentials, Kubernetes tokens and database passwords, then exfiltrated them to an attacker-controlled domain. The packages were live for roughly 40 minutes before PyPI quarantined them.
What this means for youAt work, if a developer or team installed litellm 1.82.7 or 1.82.8, treat every credential on that machine as exposed and rotate them. At home, this matters only if you run LiteLLM yourself; check your installed version and rotate SSH, cloud, and database passwords if it matches.
Sources
- LiteLLM (security update)https://docs.litellm.ai/blog/security-update-march-2026
Incident records from the AI Agent Incident Database by sipi.bot (https://sipi.bot/incidents/), licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/).
Source data license: CC BY 4.0. Attribution to sipi.bot is required.
Covered by snapshot 45
da93f03b406f409940d0a6ef47b526607f82ebf457d98f69299b88aceede576a
This entry is record number 2296. It has not been edited since it was approved; the hash above would not match if it had. How to verify