{"schema_version":"0.10.0","id":"LR-2026-0442","record_version":1,"title":"Compromised LiteLLM PyPI packages deliver credential-stealing malware","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":56.1,"score_breakdown":{"source_authority":12.1,"independent_corroboration":15.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":3.0,"completeness":4.16,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"confirmed","reason":"Wiz research","original_document":{"url":"https://www.wiz.io/blog/threes-a-crowd-teampcp-trojanizes-litellm-in-continuation-of-campaign","organisation":"Wiz","role":"researcher"},"reports_total":2,"reports_independent":1,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"confirmed","reason":"Wiz research"}]},"sources_hash":"2d07b9d740cda3acd918ff2bbf1c8469b51637cf0c2cf6721f8a76fd9578e602"},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":"Unified interface for applications that call large language model providers","safeguard_state":null,"production_intended":null},"event":{"date_occurred":"2026-03-24","date_disclosed":"2026-03-24","incident_class":"security_compromise","failure_class":null,"agent_involved":null,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"automated_monitor","summary":"LiteLLM is an open-source Python library that serves as a unified interface for applications calling large language model providers. Two malicious versions, 1.82.7 and 1.82.8, were published on the morning of 24 March 2026 and carried a credential stealer and dropper. The malware harvested environment variables, cloud and CI/CD secrets and keys and sent them to attacker-controlled domains. Sonatype's automated tooling detected and blocked the malicious versions within seconds of publication. PyPI quarantined the packages at 11:25 UTC, and the versions had been available for at least two hours. Attribution to the threat group TeamPCP is under investigation. LiteLLM has since published a security update. Affected organisations should treat impacted systems as compromised, rotate potentially exposed credentials and verify that only trusted versions are present.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":"An API token was exposed via the prior Trivy incident and was identified as the root cause.","failure_class_detail":null,"responsible_party":null,"adversarial_actor":null,"input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":"An API token was exposed in the prior Trivy incident.","primary_risk":"RK03"},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"moderate","severity_because":"Moderate test: data of others touched (the malware exfiltrates credentials) with a bounded scope stated (published at approximately 8:30 UTC, quarantined by PyPI at 11:25 UTC). Not major: no stated count of affected parties and no stated loss.","harm_class":[],"affected_description":"Organizations that installed or executed litellm versions 1.82.7 or 1.82.8","protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://www.sonatype.com/blog/compromised-litellm-pypi-package-delivers-multi-stage-credential-stealer","publisher":"Sonatype","date":"2026-03-24","type":"press","title":"Compromised litellm PyPI Package Delivers Multi-Stage Credential Stealer - Sonatype","archived_url":null,"attachment":"first_report"},{"url":"https://www.wiz.io/blog/threes-a-crowd-teampcp-trojanizes-litellm-in-continuation-of-campaign","publisher":"wiz.io","date":"2026-03-24","type":"press","title":"LiteLLM TeamPCP Supply Chain Attack: Malicious PyPI Packages | Wiz Blog - wiz.io","archived_url":null,"independence":"independent"}],"per_field_confidence":{"event.date_occurred":"C","event.incident_class":"C","event.detection_method":"C","event.root_cause_detail":"C","event.precursor_events":"C","impact.affected_description":"C","system.intended_use":"C","impact.severity":"D","impact.severity_because":"D","event.primary_risk":"D","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","event.trigger":"D","context.country":"D","system.developer":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"event.date_occurred":[{"source_index":1,"quote":"Malicious versions of the LiteLLM python package (1.82.7 and 1.82.8) were published on the morning of 24 March 2026."}],"event.incident_class":[{"source_index":0,"quote":"This morning, the widely used Python package litellm, a popular abstraction layer for interacting with large language models (LLMs), was compromised and two malicious versions released (1.82.7 and 1.82.8)."}],"event.detection_method":[{"source_index":0,"quote":"Sonatype's automated tooling immediately detected and blocked the malicious PyPI versions within seconds of publication (tracked as sonatype-2026-001357)."}],"event.root_cause_detail":[{"source_index":1,"quote":"An PyPI advisory has been posted here, identifying an API token exposed via the prior Trivy incident as the root cause."}],"event.precursor_events":[{"source_index":1,"quote":"An PyPI advisory has been posted here, identifying an API token exposed via the prior Trivy incident as the root cause."}],"impact.affected_description":[{"source_index":0,"quote":"Organizations that installed or executed the affected litellm versions should treat impacted systems as compromised."}],"system.intended_use":[{"source_index":0,"quote":"The litellm PyPI package serves as a unified interface for apps that interact with LLMs, calling models from providers including OpenAI, Anthropic, Google, and more, and is widely adopted across modern AI applications."}],"impact.severity":[{"source_index":1,"quote":"The packages were published at approximately 8:30 UTC and quarantined by PyPI at 11:25 UTC."}],"impact.severity_because":[{"source_index":1,"quote":"The packages were published at approximately 8:30 UTC and quarantined by PyPI at 11:25 UTC."}],"event.summary":[{"source_index":0,"quote":"The litellm PyPI package serves as a unified interface for apps that interact with LLMs, calling models from providers including OpenAI, Anthropic, Google, and more, and is widely adopted across modern AI applications."},{"source_index":1,"quote":"Malicious versions of the LiteLLM python package (1.82.7 and 1.82.8) were published on the morning of 24 March 2026."},{"source_index":1,"quote":"The malware exfiltrates cloud credentials, CI/CD secrets, and keys to attacker-controlled domains."},{"source_index":0,"quote":"Sonatype's automated tooling immediately detected and blocked the malicious PyPI versions within seconds of publication (tracked as sonatype-2026-001357)."},{"source_index":1,"quote":"The packages were published at approximately 8:30 UTC and quarantined by PyPI at 11:25 UTC."},{"source_index":0,"quote":"The compromised versions were available on PyPI for at least two hours."},{"source_index":0,"quote":"There are indications that this activity may be associated with the threat group TeamPCP, as well as speculation that the threat group is related to LAPSUS$."},{"source_index":1,"quote":"Update 03/25: LiteLLM has published an official and actively maintained Security Update."},{"source_index":0,"quote":"Organizations that installed or executed the affected litellm versions should treat impacted systems as compromised."},{"source_index":0,"quote":"Immediate steps should include removing the malicious litellm PyPI package, rotating all potentially exposed credentials, and conducting a thorough investigation of affected systems."},{"source_index":0,"quote":"Organizations should also verify that only trusted litellm versions are present in their environments and ensure that dependency management processes include safeguards against compromised packages."}]},"notes_on_gaps":"Not an autonomous agent incident as described by the sources, so event.agent_involved and event.failure_class are left out. No loss amount, record count, or count of affected third parties is stated. The duration of availability is only given as at least two hours, so no duration is recorded; time to contain is not computed from the timestamps. Attribution to TeamPCP is unconfirmed per source 0. Root cause category 'infrastructure' is my judgement from the exposed API token. Severity 'moderate' is my judgement: the sources state credential exfiltration with a bounded window but no count of affected parties or loss. The sources do not state the controls that held, failed or were missing in this incident, so links is empty. Sonatype's header date of 2026-03-24 is not used as date_disclosed because the sentence itself gives no disclosure date. The Wiz statement that LiteLLM is present in 36% of cloud environments describes presence, not impact, and is not used. Data categories are described as targeted, not confirmed exposed, so impact.data_categories_exposed is left out. The sources do not state what the security update changed, so no fix remediation is recorded. Sonatype's Firewall and Guide product descriptions are not controls applied in this incident and are not used. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Confirmed (Wiz research)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"doing","text":"LiteLLM is a widely used interface that apps use to call LLM providers.","quote":"The litellm PyPI package serves as a unified interface for apps that interact with LLMs, calling models from providers including OpenAI, Anthropic, Google, and more, and is widely adopted across modern AI applications.","source_index":0,"grade":"C"},{"step":"went_wrong","text":"Two malicious versions of the LiteLLM package were published to PyPI.","quote":"Malicious versions of the LiteLLM python package (1.82.7 and 1.82.8) were published on the morning of 24 March 2026.","source_index":1,"grade":"C"},{"step":"reached","text":"The compromised versions remained available on PyPI for at least two hours.","quote":"The compromised versions were available on PyPI for at least two hours.","source_index":0,"grade":"C"},{"step":"caught","text":"Sonatype's automated tooling detected and blocked the versions within seconds of publication.","quote":"Sonatype's automated tooling immediately detected and blocked the malicious PyPI versions within seconds of publication (tracked as sonatype-2026-001357).","source_index":0,"grade":"C"},{"step":"done","text":"PyPI quarantined the packages at 11:25 UTC.","quote":"The packages were published at approximately 8:30 UTC and quarantined by PyPI at 11:25 UTC.","source_index":1,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://www.sonatype.com/blog/compromised-litellm-pypi-package-delivers-multi-stage-credential-stealer","https://www.wiz.io/blog/threes-a-crowd-teampcp-trojanizes-litellm-in-continuation-of-campaign"]},"analysis":{"sections":{"timeline":[{"text":"Malicious litellm versions 1.82.7 and 1.82.8 published on the morning of the day.","quote":"Malicious versions of the LiteLLM python package (1.82.7 and 1.82.8) were published on the morning of 24 March 2026.","source_index":1,"when":"24 March 2026"},{"text":"Packages published at approximately 8:30 UTC.","quote":"The packages were published at approximately 8:30 UTC and quarantined by PyPI at 11:25 UTC.","source_index":1,"when":"approximately 8:30 UTC"},{"text":"Sonatype's tooling detected and blocked the versions within seconds of publication.","quote":"Sonatype's automated tooling immediately detected and blocked the malicious PyPI versions within seconds of publication (tracked as sonatype-2026-001357).","source_index":0,"when":null},{"text":"PyPI quarantined the packages.","quote":"The packages were published at approximately 8:30 UTC and quarantined by PyPI at 11:25 UTC.","source_index":1,"when":"11:25 UTC"},{"text":"The compromised versions were available on PyPI for at least two hours.","quote":"The compromised versions were available on PyPI for at least two hours.","source_index":0,"when":null}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://www.sonatype.com/blog/compromised-litellm-pypi-package-delivers-multi-stage-credential-stealer","https://www.wiz.io/blog/threes-a-crowd-teampcp-trojanizes-litellm-in-continuation-of-campaign"]}}