LiteLLM AI gateway releases on PyPI backdoored to steal credentials
What happened
Attackers used publishing credentials stolen through an earlier Trivy compromise to push two malicious LiteLLM releases to PyPI for a few hours. The payload harvested cloud, Kubernetes, CI/CD and database secrets and installed a backdoor. Analysts later assessed credentials from 2,500+ organizations were exposed, and AI recruiter Mercor confirmed it was affected.
LiteLLM is an open-source library that gives developers one interface to more than 100 AI model providers, with around 95 million monthly downloads, and it often sits next to the API keys for all of them. On 24 March 2026 the group TeamPCP, which had spent the previous month compromising security tools including Aqua's Trivy scanner and Checkmarx's GitHub Actions, used a hijacked maintainer account to publish versions 1.82.7 and 1.82.8. The second added a file that Python runs automatically every time it starts, so the stealer ran even if LiteLLM was never imported. It swept SSH keys, cloud and Kubernetes credentials, environment files, database passwords and crypto wallets, encrypted them and sent them to a look-alike domain, and included tools to spread inside Kubernetes clusters. A bug that made the malware multiply until a developer's machine ran out of memory helped expose it. Projects that depend on LiteLLM, such as DSPy and CrewAI, were exposed downstream. LiteLLM was compromised a second time on 21 October 2026, when version 1.107.0 was published with a credential stealer; see the separate record for that incident.
How it happened
Supply chain and access: Poisoned package. A malicious or tampered AI package, extension, plugin or MCP server was published and installed by users.
The software involved works with many AI models, so no single model maker was involved. The product was LiteLLM, which is open source, a type of AI building block. Vulnerability IDs: CVE-2026-33634.
Impact
Data was exposed. Data involved: credentials. The impact spread across a wide ecosystem of developers, users and organizations.
Severity is rated High, calculated from how far the incident reached and how sensitive the data was.
Was the AI at fault?
No. The failure was in the systems, settings or people around the AI, not in the model's behaviour.
Status and timeline
Confirmed by the affected organization, the AI vendor, a regulator or a named security research firm.
It became public on 24 Mar 2026.
PyPI quarantined the package the same day, LiteLLM's maintainers published a disclosure and brought in Mandiant, and a clean release followed on 30 March from a rebuilt publishing pipeline. Users were told to rotate every credential on affected machines.
Sources
- https://docs.litellm.ai/blog/security-update-march-2026
- https://securitylabs.datadoghq.com/articles/litellm-compromised-pypi-teampcp-supply-chain-campaign/
- https://techcrunch.com/2026/03/31/mercor-says-it-was-hit-by-cyberattack-tied-to-compromise-of-open-source-litellm-project/
- https://www.wiz.io/blog/litellm-compromised-steals-credentials