AI Risk Wire

Cases › security breach › LR-2026-0442

Compromised LiteLLM PyPI packages deliver credential-stealing malware

Confirmed Why: Wiz research · Wiz · 1 independent report

Status: action reported, no fix

Severity moderate
Reported 24 Mar 2026

No source states: loss or records, developer and model, agent tool, could do, deployer, industry.

Severity moderate: test: data of others touched (the malware exfiltrates credentials) with a bounded scope stated (published at approximately 8:30 UTC, quarantined by PyPI at 11:25 UTC). Not major: no stated count of affected parties and no stated loss.

LiteLLM is an open-source Python library that serves as a unified interface for applications calling large language model providers. Two malicious versions, 1.82.7 and 1.82.8, were published on the morning of 24 March 2026 and carried a credential stealer and dropper. The malware harvested environment variables, cloud and CI/CD secrets and keys and sent them to attacker-controlled domains. Sonatype's automated tooling detected and blocked the malicious versions within seconds of publication. PyPI quarantined the packages at 11:25 UTC, and the versions had been available for at least two hours. Attribution to the threat group TeamPCP is under investigation. LiteLLM has since published a security update. Affected organisations should treat impacted systems as compromised, rotate potentially exposed credentials and verify that only trusted versions are present.

What happened

1 · What it was doingLiteLLM is a widely used interface that apps use to call LLM providers.
2 · What went wrongTwo malicious versions of the LiteLLM package were published to PyPI.
3 · What it reached or didThe compromised versions remained available on PyPI for at least two hours.
4 · How it was caughtSonatype's automated tooling detected and blocked the versions within seconds of publication.

What was done

PyPI quarantined the packages at 11:25 UTC.

Risks

Credential and privilege abuse
Primary37 incidents

Read from the sources; not yet reviewed by a person.

Controls

Not yet read for controls. Controls that mitigate the primary risk:

Application

Short-lived, scoped credentials · Secrets kept out of the model's context · Separate identity for each agent · Least-privilege access for the agent · Alerts on unusual tool use · Activity logs · Sensitive-data checks on outbound data

Infrastructure / target

Multi-factor sign-in and password policy · Secrets scanning

Similar incidents

Mercor breached through compromised LiteLLM PyPI releases (TeamPCP)2026-06-25

All cases of this kind ›

Evidence

No source states: when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause, what set it off.

Show the full account: 5 items from the primary sources

What happened, in order

  1. 24 March 2026 Malicious litellm versions 1.82.7 and 1.82.8 published on the morning of the day.

Not dated in the sources:

  • Packages published at approximately 8:30 UTC.
  • Sonatype's tooling detected and blocked the versions within seconds of publication.
  • PyPI quarantined the packages.
  • The compromised versions were available on PyPI for at least two hours.
Show every field, with its source and grade

The AI system

What it was for
Unified interface for applications that call large language model providers
C one secondary source states it

What happened

When it happened
2026-03-24
C one secondary source states it
Who caught it
automated monitoring
C one secondary source states it
Cause in detail
An API token was exposed via the prior Trivy incident and was identified as the root cause.
C one secondary source states it
Earlier warning signs
An API token was exposed in the prior Trivy incident.
C one secondary source states it
What went wrong
security breach
C one secondary source states it
primary risk
RK03
D inferred by us from the described behaviour, reason shown

Impact

Severity
moderate
D inferred by us from the described behaviour, reason shown
Who was affected
Organizations that installed or executed litellm versions 1.82.7 or 1.82.8
C one secondary source states it
Why this severity
test: data of others touched (the malware exfiltrates credentials) with a bounded scope stated (published at approximately 8:30 UTC, quarantined by PyPI at 11:25 UTC). Not major: no stated count of affected parties and no stated loss.
D inferred by us from the described behaviour, reason shown

Notes on gaps

The Wiz statement that LiteLLM is present in 36% of cloud environments describes presence, not impact, and is not used. Sonatype's Firewall and Guide product descriptions are not controls applied in this incident and are not used.

LR-2026-0442 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON