LiteLLM Supply Chain Attack Threatens Over 2,500 Organizations

Step by step
How the attack unfolded
Click a phase for details – or let the animation play through.
PHASE 1/7 · Supply Chain Compromise

An unrevoked access token was abused across three tools to inject malicious code into LiteLLM's build and release environment.

T1195.001 – Compromise Software Dependencies and Development Tools T1552.001 – Unsecured Credentials: Credentials In Files
  • Abuse of a token in the context of the Trivy scanner
  • Attack chain: Trivy → LiteLLM build system → LiteLLM release
  • A single credential leak led to ecosystem-wide exposure
PHASE 2/7 · Malicious Package Distribution

Two tampered LiteLLM versions were uploaded to PyPI and downloaded thousands of times.

T1195.002 – Compromise Software Supply Chain
  • Compromised versions litellm==1.82.7 and litellm==1.82.8 on 2026-03-24
  • Over 119,000 downloads during the attack window
  • 40–50% of installs were unpinned and auto-pulled the poisoned version
  • PyPI: 2h 32min from upload to quarantine
PHASE 3/7 · Execution

The malicious code executed automatically at Python startup, without LiteLLM being actively imported.

T1059.006 – Command and Scripting Interpreter: Python
  • Version 1.82.8 contained litellm_init.pth (executed at interpreter startup)
  • Version 1.82.7: payload in litellm/proxy/proxy_server.py
  • Fetched additional instructions from checkmarx[.]zone/raw
PHASE 4/7 · Credential Collection

The malware systematically scanned the system for API keys, cloud, SSH and database credentials.

T1552.001 – Unsecured Credentials: Credentials In Files T1552.005 – Cloud Instance Metadata API T1555 – Credentials from Password Stores
  • Harvested from environment variables, .env files, LDAP configs and shell histories
  • Accessed SSH keys, database, Kubernetes, Git and container credentials
  • Attempted to read cloud metadata tokens and AWS Secrets Manager contents
  • Also targeted crypto wallet keys
PHASE 5/7 · Persistence

The malware set up disguised mechanisms to persist within the system.

T1543.002 – Create or Modify System Process: Systemd Service
  • systemd service disguised as 'System Telemetry Service'
  • Creation of a pod in Kubernetes environments
  • FBI links the activity to the group TeamPCP (FLASH-20260702-01)
PHASE 6/7 · Exfiltration

The collected credentials were transmitted encrypted to an attacker-controlled domain.

T1567 – Exfiltration Over Web Service T1041 – Exfiltration Over C2 Channel
  • Exfiltration to models.litellm[.]cloud (not part of the official project)
  • Encrypted transmission of credentials
PHASE 7/7 · Impact

Thousands of organizations and hundreds of thousands of build pipelines were potentially exposed.

  • 2,500+ potentially exposed organizations (CloudSEK reconstruction)
  • 434,000 potentially exposed CI/CD pipelines
  • No blanket proof of compromise – distinction between exposed and compromised
  • Clean version 1.83.0 released on 2026-03-30 via new CI/CD v2 pipeline
Short & clear answers
Frequently asked questions about this incident
Am I affected by the LiteLLM incident?
Mainly affected are systems that pulled the Python packages litellm==1.82.7 or litellm==1.82.8 from PyPI on March 24, 2026 – for example through unpinned installs, automatic upgrades, or Docker image builds. According to the vendor, users of the official LiteLLM Proxy Docker image were not affected, because it pins its dependencies. Version 1.82.6 or older without an upgrade, as well as a static CMS without Python/LiteLLM, are also not directly affected by this package.
How do I check whether I installed the malicious version?
Check your active environment with `python -m pip show litellm` and additionally search requirements files, lockfiles, containerfiles, and build/deployment logs for litellm==1.82.7 or litellm==1.82.8. Also search each affected host for the file litellm_init.pth (e.g. with `find /usr/lib/python3.13/site-packages/ -name "litellm_init.pth"`). Finding this file is a clear warning sign.
What exactly should I do now?
Inventory all Python environments (developer machines, servers, containers, CI/CD runners) and search your logs across the entire day of March 24, 2026. Check proxy, DNS, and firewall logs for outbound traffic to models.litellm[.]cloud and checkmarx[.]zone, and for unknown systemd services ("System Telemetry Service") or Kubernetes pods. Upgrade to the verified clean version 1.83.0, released on March 30, 2026.
What data could have been stolen?
The malware was designed to harvest credentials from environment variables and .env files, as well as cloud access, SSH keys, database passwords, Kubernetes secrets, Git, container and LDAP configurations, shell histories, and even crypto wallet keys. This data was exfiltrated encrypted to an external domain. Any secret accessible to an affected process should be considered potentially compromised and rotated.
Do the 2,500 affected organizations mean my company was definitely hacked?
No. The figures from CloudSEK (2,500+ organizations, 434,000 CI/CD pipelines) describe reconstructed potential exposure and are not proof that every organization was successfully compromised or that every credential was stolen. There are three levels to distinguish: exposed, likely compromised, and confirmed compromised. A confirmed total number of leaked personal data records is not available in the verified sources.
More security news
You might also be interested in
Critical Elementor Pro Flaw: Attackers Can Fully Take Over WordPress Sites
A file upload bug in Elementor Pro up to 4.2.1 allows RCE without login. Version 4.2.2 fixes the flaw – update now!
Pods Plugin: Critical Flaw Enables Admin Takeover, No Login
A critical flaw in the WordPress plugin Pods lets attackers overwrite admin passwords without login. Over 100,000 sites are affected.
miniOrange SAML SSO: Critical Bypass Turns Attackers Into Admins
Two critical auth bypasses in the miniOrange SAML SSO plugin allow forged SAML assertions—up to full WordPress admin access.