Malicious LiteLLM Releases Tied to Trivy Hack May Have Exposed 2,100+ Organizations

Two malicious LiteLLM releases on PyPI, versions 1.82.7 and 1.82.8, were live for about 40 minutes on March 24, 2026, carrying credential-stealing code. Threat intelligence firm CloudSEK obtained a dataset of roughly 434,000 captured files, mapping potential exposure to more than 2,500 organizations, though it emphasizes this is not a victim count. The files were taken from affected systems and include cloud keys, SSH keys, Kubernetes tokens, and database passwords.

LiteLLM, an open-source AI gateway, identified the compromised versions and advised users to treat any install on March 24 up to 16:00 UTC as suspect. The malicious packages included a file named litellm_init.pth that executed at Python interpreter startup, harvesting environment variables and credentials before exfiltrating them to an attacker-controlled domain. The campaign is part of the broader TeamPCP supply-chain attack linked to Aqua Security’s Trivy scanner, tracked as CVE-2026-33634 and added to CISA’s Known Exploited Vulnerabilities catalog.

High-profile organizations such as NVIDIA, Cisco, Deloitte, Volkswagen, FedEx, Siemens, and X Corp appear in the dataset, but CloudSEK and LiteLLM stress that stolen credentials may not have been used. The FBI’s advisory FLASH-20260702-01 warns that affiliated actors may weaponize exfiltrated credentials long after the initial compromise. Affected organizations should rotate CI/CD secrets, cloud credentials, and other sensitive tokens, and search for repositories named tpcp-docs or docs-tpcp as campaign indicators.

Downstream impact is confirmed: Checkmarx reported unauthorized access to its GitHub repositories, Mercor was affected by malicious LiteLLM versions, and CERT-EU assessed with high confidence that a European Commission AWS account was compromised. Organizations should check for LiteLLM 1.82.7 or 1.82.8 installations, rotate any accessible secrets, and search for the indicator repositories.