Observed Signal · Mar 27, 2026 · Supply Chain Attack · Source: DEV Community · Impact: 4/5 · Sentiment: Negative
LiteLLM PyPI Backdoor Exposes Python LLM Gateway Risk
On March 24, 2026, threat actor group TeamPCP used stolen CI credentials (exfiltrated via a compromised Trivy GitHub Action) to publish two backdoored LiteLLM releases (1.82.7 and 1.82.8) to PyPI. The multi-stage malware harvested SSH keys, cloud (AWS/GCP/Azure) credentials, Kubernetes secrets, cryptocurrency wallets, and installed persistent backdoors; exfiltration used models.litellm.cloud. Version 1.82.8 employed a litellm_init.pth startup hook that ran on interpreter start, widening impact beyond explicit imports. Snyk, Wiz, FutureSearch and LiteLLM published technical analyses and mitigations. The incident highlights systemic Python supply-chain risks for LLM gateways (packages that hold provider API keys) and recommends immediate steps: check versions, scan for malicious .pth files, rotate credentials, pin dependencies and CI actions, and consider compiled or managed gateway alternatives.
A supply-chain compromise of a widely used Python LLM gateway exposes high-privilege credentials and infrastructure; it reveals structural risks in Python packaging that can affect any AI/LLM deployments and downstream projects, making it broadly relevant for companies running LLMs and AI infrastructure.
Track Anthropic Signals & Market Shifts in Real-Time
Polaris7 autonomous intelligence agents track regulatory filings, primary sources, executive changes, and deal flow 24/7. Create your free Explorer workspace to monitor these entities.
Key Takeaways & Evidence Grounding
- On March 24, 2026 two backdoored LiteLLM versions (1.82.7 and 1.82.8) were published to PyPI using a stolen PYPI_PUBLISH token.
- The attack chain began after TeamPCP exploited a pull_request_target workflow vulnerability in Trivy's GitHub Action to exfiltrate credentials and poison releases.
- Malware performed three-stage operations: extensive credential & secret harvesting, AES-256-CBC encryption with RSA-wrapped keys and exfiltration, and persistent backdoor installation with periodic C2 polling.
- Version 1.82.8 installed litellm_init.pth in site-packages so malicious code executed on every Python interpreter startup (MITRE T1546.018).
- Snyk, Wiz, FutureSearch and LiteLLM published technical analyses and mitigations; downstream projects that pinned versions (e.g., Aider) avoided compromise.
Connected Companies & Entities
5 Entities mappedOntology Mapping & Concepts
Related Market Signals & Shifts
Recent verified developments and strategic activity across this market segment.
Litellm PyPI Supply-Chain Attack Targets LLM API Keys
Two malicious Litellm releases (notably v1.82.8) on PyPI contained a multi-stage backdoor that exfiltrated environment variables, LLM API keys, SSH keys, cloud credentials, Kubernetes configs and crypto wallets before being removed. The compromised package was discovered as a transitive dependency inside Cursor when an MCP plugin pulled it. Security vendors (GitGuardian, Snyk, JFrog, Endor Labs) and high-profile posts amplified the incident. The article argues the root reason the attack succeeded is common patterns in so‑called "vibe‑coded" apps: transitive dependencies, absent security reviews of AI-generated code, and insecurely stored credentials. Large scans (Escape.tech and others) reportedly found thousands of vulnerabilities and hundreds of exposed secrets in vibe-coded projects. The piece lists a five-step rapid audit and promotes VibeCheck (a free scanner) plus a paid Vibe Coding Security Playbook with remediation prompts.
LiteLLM Malware Exposes Delve Compliance Claims
A severe supply‑chain malware infection was discovered in LiteLLM, a popular open‑source project that provides unified access to many AI models. Research scientist Callum McMahon of FutureSearch found the malware after his machine shut down following a LiteLLM download; the malicious code entered via a dependency, stole login credentials and propagated to other packages. Security firm Snyk reported LiteLLM downloads as high as 3.4 million per day and noted the project had ~40K GitHub stars. LiteLLM displayed SOC 2 and ISO 27001 certifications obtained through Delve, an AI‑powered compliance startup now accused elsewhere of misleading customers about conformity (Delve denies the allegations). LiteLLM says it is investigating with Mandiant and performing a forensic review; CEO Krrish Dholakia declined to comment on Delve’s role. The incident highlights risks in dependency management and limits of certification-based assurances.
Malicious elementary-data PyPI Release Steals Credentials
A malicious version (0.23.3) of the widely used Python package elementary-data was published to PyPI after attackers exploited a GitHub Actions workflow injection. The package contained an elementary.pth startup hook that harvested a broad set of credentials (dbt profiles, cloud provider keys, SSH keys, kube/configs, package manager tokens, cryptocurrency wallets) and exfiltrated them to a command-and-control domain. The compromise was live on PyPI from April 24–25, 2026 and was removed after community reporting; Snyk assigned the issue a Critical severity (CVSS v4.0: 9.3) and published advisory SNYK-PYTHON-ELEMENTARYDATA-16316110. Remediation steps include upgrading to elementary-data>=0.23.4, rotating potentially exposed credentials, removing cached .pth artifacts, pulling clean Docker images, and hardening GitHub Actions (use short-lived OIDC tokens / Trusted Publishers and avoid unquoted context interpolation).
Track Real-Time Market Signals & Shifts
Set up custom watchlists to receive automated, evidence-grounded executive digests whenever material signals or shifts occur across your tracked landscape.