LiteLLM Supply Chain Attack Analysis: Credential Stealer and Backdoor Compromise in PyPI Packages (March 2026)

Executive Summary

On March, 2026, the maintainers of LiteLLM identified a critical supply chain compromise affecting specific versions of their PyPI package. The attack involved the insertion of a credential-stealing and backdoor payload into LiteLLM versions 1.82.7 and 1.82.8, with a related incident later impacting version 1.107.0. The malicious packages were available for approximately 40 minutes before removal. The compromise originated from a previously infected Trivy dependency in the CI/CD pipeline, and in a related event, attackers leveraged stolen GitHub CLI OAuth tokens from engineers to approve malicious releases. The malware harvested a wide range of secrets, including cloud provider credentials, API keys, and Kubernetes tokens, and exfiltrated them to attacker-controlled domains. The incident posed a significant risk to organizations using LiteLLM as an AI/ML proxy, especially those with centralized secrets. Immediate remediation steps included removal of malicious packages, credential rotation, and forensic investigation. All claims in this summary are corroborated by official disclosure, technical analysis, and independent news reporting (LiteLLM Security Update, Trend Micro, The Hacker News).

Technical Information

The LiteLLM supply chain compromise represents a sophisticated attack leveraging both dependency poisoning and credential theft. The initial access vector was a compromised Trivy dependency, which enabled attackers to bypass official CI/CD workflows and upload malicious LiteLLM packages directly to PyPI. In a related incident, attackers used stolen GitHub CLI OAuth tokens from three engineers to trigger and approve a malicious release, demonstrating a secondary access vector via developer account compromise (LiteLLM Security Update, The Hacker News).

Persistence was achieved through the use of Python .pth files (litellm_init.pth, cook.pth), which executed malicious code at interpreter startup. The payload was a three-stage, base64-encoded Python script that performed credential harvesting, attempted Kubernetes lateral movement, and established a persistent backdoor for remote code execution (Trend Micro). The credential harvester targeted over 50 categories of secrets, including SSH keys, cloud provider credentials (AWS, GCP, Azure), Kubernetes tokens, Docker tokens, npm tokens, Vault tokens, cryptocurrency wallets, and CI/CD secrets. Stolen credentials were encrypted using a hybrid RSA-4096 and AES-256 scheme before exfiltration via HTTPS POST to models.litellm[.]cloud. The backdoor polled checkmarx[.]zone every 50 minutes for second-stage payloads and could execute arbitrary code from attacker-controlled endpoints.

The attack was discovered due to a bug in the malicious payload that caused system crashes (fork bomb), leading to rapid detection and removal. The campaign, attributed to the threat actor TeamPCP, spanned multiple ecosystems, including PyPI, npm, Docker Hub, GitHub Actions, and OpenVSX, and was enabled by compromised CI/CD pipelines and developer credentials (Trend Micro). The malware also checked a GitHub repository for additional domains to target and could execute further code from attacker-controlled endpoints (The Hacker News).

Sector-specific impacts were pronounced in AI/ML environments, where the concentration of API keys and credentials in LiteLLM deployments increased the blast radius of compromise. Downstream projects and frameworks that pulled LiteLLM as a dependency were also at risk (LiteLLM Security Update, Trend Micro).

The technical details of the attack map to several MITRE ATT&CK techniques, including T1195 (Supply Chain Compromise), T1552 (Unsecured Credentials), T1546.007 (Python .pth Persistence), T1071.001 (Web Protocols for C2), T1027 (Obfuscated Files/Info), T1550 (Use Alternate Authentication Material), and T1570 (Lateral Tool Transfer). Confidence in these mappings is high, as they are supported by direct technical evidence and malware analysis from multiple primary sources.

Affected Versions & Timeline

The compromise affected LiteLLM versions 1.82.7 and 1.82.8, which were published to PyPI on March 24, 2026, and remained available for approximately 40 minutes before removal (LiteLLM Security Update). A related incident impacted version 1.107.0, distributed through PyPI wheels and Docker images, which were subsequently quarantined and removed (The Hacker News). The attack was discovered due to system instability caused by the malicious payload. Immediate actions included removal of compromised packages, credential rotation, and engagement of forensic experts. A clean version, 1.83.0, was released on March 30, 2026, with enhanced CI/CD security controls.

Threat Activity

The threat actor, identified as TeamPCP, has a history of targeting the software supply chain and CI/CD security tooling, previously compromising tools such as Trivy and Checkmarx KICS (Trend Micro). The campaign leveraged both dependency poisoning and credential theft, with a focus on harvesting secrets from AI/ML environments. The malware’s three-stage payload enabled credential harvesting, Kubernetes lateral movement, and persistent backdoor access. Exfiltration was performed via HTTPS POST to attacker-controlled domains, and the backdoor polled for additional payloads. The campaign’s scope included multiple ecosystems and was enabled by compromised CI/CD pipelines and developer credentials. Attribution to TeamPCP is based on technical analysis and campaign patterns, with medium-high confidence.

Mitigation & Workarounds

Organizations should immediately rotate all secrets and credentials exposed to environments where affected LiteLLM versions were installed (Critical). It is essential to audit for the presence of malicious .pth files (litellm_init.pth, cook.pth) in Python site-packages and monitor for suspicious outbound traffic to the identified attacker-controlled domains (Critical). Dependency pinning and the use of official Docker images are strongly recommended to reduce exposure to supply chain attacks (High). Implementing egress filtering and behavioral detection for credential theft can help prevent future incidents (High). Reviewing CI/CD pipeline security, restricting the use of third-party dependencies, and enforcing least privilege for developer credentials are also advised (High). Downstream projects and frameworks that pulled LiteLLM as a dependency should be audited for exposure (High).

Indicators of Compromise

The following indicators are point-in-time and should be validated before enforcement. They are based solely on evidence from primary sources and are defanged for safe publication.

References

https://docs.litellm.ai/blog/security-update-march-2026 https://www.trendmicro.com/en/research/26/c/inside-litellm-supply-chain-compromise.html https://thehackernews.com/2026/10/litellm-compromised-in-supply-chain.html

About Rescana

Rescana provides a Third-Party Risk Management (TPRM) platform designed to help organizations identify, assess, and monitor supply chain risks, including software dependency exposures and CI/CD pipeline vulnerabilities. Our platform enables continuous monitoring of vendor ecosystems, automated risk assessments, and actionable insights for incident response and remediation.

We are happy to answer questions at info@rescana.com.