{"schema_version":"0.10.0","id":"LR-2026-0502","record_version":1,"title":"LiteLLM compromise turned developer machines into credential vaults","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":43.8,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":0.0,"completeness":3.52,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"1 report: The Hacker News · subject to change","original_document":null,"reports_total":1,"reports_independent":1,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"preliminary","reason":"1 report: The Hacker News · subject to change"}]},"sources_hash":"35768df7e6244a520141f106bde1f25936091bc7975d0394733733d6cd512302"},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-04-06","incident_class":"security_compromise","failure_class":null,"agent_involved":null,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"unknown","summary":"In March 2026, a threat actor called TeamPCP compromised versions 1.82.7 and 1.82.8 of LiteLLM, a popular AI development library, on PyPI. The packages carried infostealer malware that activated when developers installed or updated them. The malware harvested SSH keys, cloud credentials for AWS, Azure and GCP, Docker configurations and other sensitive data from developer machines, needing only the plaintext secrets already on disk. PyPI removed the malicious packages within hours of detection. A GitGuardian analysis found 1,705 PyPI packages configured to pull the compromised versions automatically, so organizations that never used LiteLLM directly could still be affected through transitive dependencies.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":"third_party","adversarial_actor":null,"input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":"PyPI removed the malicious packages within hours of detection","precursor_events":null,"primary_risk":"RK06","secondary_risks":["RK03"]},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"severe","severity_because":"Test met: one shared component (LiteLLM, downloaded millions of times daily) correlating loss across deployers. The source states organizations that never used LiteLLM directly could be compromised through transitive dependencies.","harm_class":[],"affected_description":null,"protected_class_involved":null,"data_categories_exposed":["ssh_keys","cloud_credentials","docker_configurations"],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://thehackernews.com/2026/04/how-litellm-turned-developer-machines.html","publisher":"The Hacker News","date":"2026-04-06","type":"press","title":"How LiteLLM Turned Developer Machines Into Credential Vaults for Attackers - The Hacker News","archived_url":null,"attachment":"first_report","independence":"independent"}],"per_field_confidence":{"event.incident_class":"C","event.responsible_party":"C","event.remediation":"C","impact.data_categories_exposed":"C","impact.severity":"D","impact.severity_because":"D","event.primary_risk":"D","event.secondary_risks":"D","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","event.trigger":"D","event.detection_method":"D","context.country":"D","system.developer":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"event.incident_class":[{"source_index":0,"quote":"Their supply chain attack on LiteLLM, a popular AI development library downloaded millions of times daily, turned developer endpoints into systematic credential harvesting operations."}],"event.responsible_party":[{"source_index":0,"quote":"TeamPCP compromised LiteLLM packages versions 1.82.7 and 1.82.8 on PyPI, injecting infostealer malware that activated when developers installed or updated the package."}],"event.remediation":[{"source_index":0,"quote":"PyPI removed the malicious packages within hours of detection, but the damage window was significant."}],"impact.data_categories_exposed":[{"source_index":0,"quote":"The malware systematically harvested SSH keys, cloud credentials for AWS, Azure, and GCP, Docker configurations, and other sensitive data from developer machines."}],"impact.severity":[{"source_index":0,"quote":"The cascade effect meant organizations that never directly used LiteLLM could still be compromised through transitive dependencies."}],"impact.severity_because":[{"source_index":0,"quote":"The cascade effect meant organizations that never directly used LiteLLM could still be compromised through transitive dependencies."}],"event.summary":[{"source_index":0,"quote":"In March 2026, the TeamPCP threat actor proved just how valuable developer machines are."},{"source_index":0,"quote":"TeamPCP compromised LiteLLM packages versions 1.82.7 and 1.82.8 on PyPI, injecting infostealer malware that activated when developers installed or updated the package."},{"source_index":0,"quote":"The malware systematically harvested SSH keys, cloud credentials for AWS, Azure, and GCP, Docker configurations, and other sensitive data from developer machines."},{"source_index":0,"quote":"PyPI removed the malicious packages within hours of detection, but the damage window was significant."},{"source_index":0,"quote":"GitGuardian's analysis found that 1,705 PyPI packages were configured to automatically pull the compromised LiteLLM versions as dependencies."},{"source_index":0,"quote":"The cascade effect meant organizations that never directly used LiteLLM could still be compromised through transitive dependencies."}]},"notes_on_gaps":"Only one source, a vendor-authored press article. LiteLLM is a software library, and the source does not describe an autonomous AI agent, so agent fields (agent_involved, failure_class, autonomy) are omitted. No system model name, version, harness or deployment context is stated. The article's 2026-04-06 date is header metadata and is not treated as a disclosure date; date_disclosed and date_detected are omitted. No detection method or detecting party is stated. The event.date_occurred is month-only (2026-03). No closed trigger fits the stated cause, so trigger is omitted. Duration and time_to_contain are omitted because only 'within hours' is given. Counts of affected parties and direct loss are not stated; 1,705 is a count of packages configured to pull the versions, not confirmed affected parties, so it is not used as a count. Severity 'severe' is my judgement under the shared-component test. Control H3 outcome 'missing' is inferred from the statement that secrets were plaintext. The context industry and country are not stated. Remediation by PyPI (package removal) has no matching control id, so it is not listed as a remediation entry. The advice entries are recommendations from the vendor, not changes made in this incident. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Preliminary (1 report: The Hacker News · subject to change)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"reached","text":"Many PyPI packages were set to pull the compromised LiteLLM versions automatically as dependencies.","quote":"GitGuardian's analysis found that 1,705 PyPI packages were configured to automatically pull the compromised LiteLLM versions as dependencies.","source_index":0,"grade":"C"},{"step":"caught","text":"PyPI removed the malicious packages within hours of detection.","quote":"PyPI removed the malicious packages within hours of detection, but the damage window was significant.","source_index":0,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://thehackernews.com/2026/04/how-litellm-turned-developer-machines.html"]},"analysis":{"sections":{"timeline":[{"text":"TeamPCP threat actor's supply chain attack on LiteLLM occurs in March 2026.","quote":"In March 2026, the TeamPCP threat actor proved just how valuable developer machines are.","source_index":0,"when":"2026-03"},{"text":"PyPI removes the malicious packages within hours of detection.","quote":"PyPI removed the malicious packages within hours of detection, but the damage window was significant.","source_index":0,"when":null},{"text":"GitGuardian analysis finds 1,705 PyPI packages configured to automatically pull the compromised LiteLLM versions.","quote":"GitGuardian's analysis found that 1,705 PyPI packages were configured to automatically pull the compromised LiteLLM versions as dependencies.","source_index":0,"when":null}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://thehackernews.com/2026/04/how-litellm-turned-developer-machines.html"]}}