LiteLLM Hit in Cascading Supply-Chain Attack

A threat actor pushed two malware-laced versions of LiteLLM to a central repository where Python developers fetch open-source packages. The packages were downloaded 47,000 times in 46 minutes before PyPI pulled them down.

See Also: AI or Data Governance? Gartner Says You Need Both

LiteLLM is a widely used open-source Python library that allows developers to connect applications to different artificial intelligence model providers through a single interface.

Callum McMahon, a developer at Latent Space, discovered the attack by hacker group TeamPCP after his machine crashed because the malware caused an uncontrolled chain of processes to spawn on his computer. McMahon traced the problem to a rogue package in his local cache and reported it to PyPI’s security team and LiteLLM’s maintainers. PyPI quarantined the package.

The two compromised versions 1.82.7 and 1.82.8 were available for about five hours from 10:39 UTC on Tuesday.

LiteLLM said the attacker bypassed its official workflows and uploaded the packages directly to PyPI, probably by compromising a maintainer’s account. The malicious code stole credentials including environment variables, SSH keys, cloud provider credentials from AWS, GCP and Azure, Kubernetes tokens and database passwords, and sent them to a server at models.litellm.cloud, a domain not affiliated with LiteLLM.

Developers who installed these versions with unpinned dependencies – where a project is set to automatically fetch the latest available version rather than a fixed one – were exposed. Customers using LiteLLM Cloud or the official LiteLLM Proxy Docker image were not affected.

The breach appears to be downstream fallout from an earlier compromise of Trivy, an open-source security scanning tool built by Aqua Security that is widely used in automated software build and deployment pipelines. On March 19, TeamPCP used credentials left over from a prior, incompletely resolved Trivy incident to tamper with Trivy’s GitHub Actions, the automated workflows that build and distribute the tool. Attackers overwrote version references in Trivy’s workflows to point to their own malicious code. Any pipeline that called those versions ran the attackers’ code without knowing it. This gave TeamPCP access to credentials and secrets across affected environments, which security researchers believe the group then used to poison LiteLLM’s release chain on PyPI.

The incident “is exactly the kind of cascading, transitive risk security teams worry about most,” said Cory Michal, CISO at AppOmni.

Beyond credential theft, the malicious packages installed tools for moving laterally through Kubernetes environments and a persistent backdoor. Kubernetes is the infrastructure system many organizations use to run and scale software, and access to it can give attackers broad reach across a network.

Palo Alto Networks, which analyzed the broader Trivy campaign, described it as the most sophisticated supply-chain attack on a security tool to date, combining credential theft, tag poisoning, binary tampering, persistent backdoors and a self-propagating worm that spread across npm, the package registry used by JavaScript developers.

LiteLLM paused new releases, rotated maintainer credentials, established new authorized maintainers and engaged Google’s Mandiant team for forensic analysis of the build and publishing chain.

On remediation, “it’s the same thing we have been doing everywhere else to keep us safe: reduce the attack surface, pin your dependencies, or even better use lock files with checksums, audit packages before upgrading,” McMahon said. “And when Claude tells you everything is fine, maybe ask it twice.