AI Risk Wire

Cases › security breach › LR-2026-0502

LiteLLM compromise turned developer machines into credential vaults

Preliminary Why: 1 report: The Hacker News · subject to change · 1 independent report

Developing: a major or severe case captured in the last 72 hours. Later changes are logged on the corrections page.

Status: fix reported

Severity severe
Reported 6 Apr 2026

No source states: loss or records, developer and model, agent tool, could do, deployer, industry.

Severity severe: Test met: one shared component (LiteLLM, downloaded millions of times daily) correlating loss across deployers. The source states organizations that never used LiteLLM directly could be compromised through transitive dependencies.

In March 2026, a threat actor called TeamPCP compromised versions 1.82.7 and 1.82.8 of LiteLLM, a popular AI development library, on PyPI. The packages carried infostealer malware that activated when developers installed or updated them. The malware harvested SSH keys, cloud credentials for AWS, Azure and GCP, Docker configurations and other sensitive data from developer machines, needing only the plaintext secrets already on disk. PyPI removed the malicious packages within hours of detection. A GitGuardian analysis found 1,705 PyPI packages configured to pull the compromised versions automatically, so organizations that never used LiteLLM directly could still be affected through transitive dependencies.

What happened

1 · What it reached or didMany PyPI packages were set to pull the compromised LiteLLM versions automatically as dependencies.
2 · How it was caughtPyPI removed the malicious packages within hours of detection.

What was done

Fix reported

“PyPI removed the malicious packages within hours of detection”

Signed and verified components

Risks

Supply-chain compromise
Primary24 incidents
Rising: 4 vs 0.2 a week
Credential and privilege abuse
Also37 incidents

Read from the sources; not yet reviewed by a person.

Controls

Not yet read for controls. Controls that mitigate the primary risk:

Harness

Sandboxed code execution

Application

Signed and verified components · Vetting of plug-ins, skills and dependencies · AI bill of materials · Vulnerability scanning of AI components · Model provenance checks · Least-privilege access for the agent

Infrastructure / target

Secrets scanning

Evidence

No source states: what the AI was doing, what went wrong, when it happened, when it was found, how many records were exposed, the direct loss, any court case, the cause, what set it off, what was done.

Show the full account: 3 items from the primary sources

What happened, in order

  1. 2026-03 TeamPCP threat actor's supply chain attack on LiteLLM occurs in March 2026.

Not dated in the sources:

  • PyPI removes the malicious packages within hours of detection.
  • GitGuardian analysis finds 1,705 PyPI packages configured to automatically pull the compromised LiteLLM versions.
Show every field, with its source and grade

What happened

Earliest source we hold
2026-04-06
D inferred by us from the described behaviour, reason shown
Who was responsible
an outside party
C one secondary source states it
What was done
PyPI removed the malicious packages within hours of detection
C one secondary source states it
What went wrong
security breach
C one secondary source states it
primary risk
RK06
D inferred by us from the described behaviour, reason shown
secondary risks
RK03
D inferred by us from the described behaviour, reason shown

Impact

Severity
severe
D inferred by us from the described behaviour, reason shown
Kinds of data exposed
SSH keys, cloud credentials, docker configurations
C one secondary source states it
Why this severity
Test met: one shared component (LiteLLM, downloaded millions of times daily) correlating loss across deployers. The source states organizations that never used LiteLLM directly could be compromised through transitive dependencies.
D inferred by us from the described behaviour, reason shown

Notes on gaps

Remediation by PyPI (package removal) has no matching control id, so it is not listed as a remediation entry.

LR-2026-0502 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON