LiteLLM supply chain attack exposes credentials for 2,500+ organizations

A major software supply chain attack targeting LiteLLM, an open-source gateway used to connect applications with large language model providers, has potentially exposed credentials for over 2,500 organizations. While malicious packages appeared on the Python Package Index (PyPI) for a limited window in March 2026, researchers from SOCRadar indicate the actual impact may have spanned approximately five days, involving the capture of roughly 434,000 CI/CD files.

The compromise involved poisoned versions 1.82.7 and 1.82.8 of LiteLLM. Attackers, linked to the group TeamPCP (tracked by Google as UNC6780), targeted cloud credentials, SSH keys, Kubernetes secrets, database passwords, and API keys for services such as OpenAI and Anthropic. One specific version included a Python startup file capable of executing malicious code even if developers did not directly import the library.

Because LiteLLM is a core dependency for many AI agent frameworks—including CrewAI, DSPy, MLflow, OpenHands, and Arize Phoenix—the attack's blast radius extended to organizations that installed these frameworks indirectly. The malware was designed to search compromised systems for sensitive data across AWS, Google Cloud, and Azure environments.