A supply chain breach involving LiteLLM underscores how a fleeting malicious package can lead to long-term vulnerabilities across cloud environments, continuous integration/deployment (CI/CD) systems, source-code repositories, Kubernetes clusters, package registries, and AI services This article explores compromised versions litellm. . CloudSEK revealed that the March 2026 campaign was orchestrated by Team PCP and involved compromised versions of LiteLLM 1.82.7 and 1.82.8 on PyPI.
A developer workstation or CI runner might hold cloud credentials, GitHub tokens, SSH keys, Kubernetes service-account tokens, environment variables, registry credentials, database connections, and LLM API keys. The malicious components utilized a .pth file, which executes upon Python interpreter startup, allowing the payload to execute even if an application does not explicitly import LiteLLM.
Once active on a CI runner, the payload could search for credentials in environment variables, local files, process memory, cloud instance metadata services, and mounted Kubernetes service-account paths. The report disclosed that the targeted data encompassed AWS, Azure, and Google Cloud credentials; repository tokens; SSH keys; Kubernetes secrets; package publishing tokens; AI-provider keys, cloud security tools, and more. In instances where external exfiltration attempts failed, malware allegedly created public GitHub repositories in victim accounts and uploaded the collected data as release assets.
