LiteLLM supply chain attack

A software supply chain attack targeted LiteLLM, an open-source AI gateway, potentially exposing credentials for over 2,500 organizations. The breach occurred when attackers compromised the release process for the Trivy scanner, allowing poisoned code to enter the LiteLLM build pipeline and produce malicious packages on the Python Package Index (PyPI).

Malicious versions 1.82.7 and 1.82.8 were available for a limited window, with some researchers suggesting the impact may have spanned approximately five days. The malware was designed to steal sensitive data, including cloud keys, SSH keys, Kubernetes tokens, database passwords, and LLM API keys for services like OpenAI and Anthropic. The attack's reach extended to organizations using AI agent frameworks such as CrewAI, DSPy, and MLflow, as LiteLLM serves as a core dependency for these tools.

Analysts have attributed the campaign to the group TeamPCP (also tracked as UNC6780). While major entities such as NVIDIA, Cisco, and Volkswagen were identified as potentially affected, researchers noted that exposure does not confirm a successful breach for every named organization. Experts advise affected parties to rotate all credentials immediately.