Malicious Code on PyPI Exposed Secrets at 2,500 Organizations, Report Says

Two poisoned releases of the open-source AI gateway LiteLLM sat on the Python Package Index for roughly 40 minutes in March, carrying code designed to steal cloud keys, SSH credentials, Kubernetes tokens, database passwords, and other secrets from any system that installed them. Threat intelligence firm CloudSEK now reports that a dataset it obtained — built from approximately 434,000 files the attackers captured — maps potential exposure to more than 2,500 organizations. Those totals don't represent a confirmed victim count, the firm said, because the material came from confidential intelligence sources and consists of captured loot and log files it assessed as belonging to the campaign, not data gathered from the organizations it names.

The malicious versions, 1.82.7 and 1.82.8, were live on March 24 from 10:39 UTC for about 40 minutes before PyPI quarantined them, though LiteLLM tells users to treat any install that day up to 16:00 UTC as suspect. Version 1.82.8 included a file named litellm_init.pth that Python processes at interpreter startup, so it ran whenever a Python process started in that environment, whether or not anything imported LiteLLM. The compromised packages were designed to collect environment variables, SSH keys, cloud credentials, Kubernetes tokens, and database passwords before encrypting and sending stolen data to models.litellm[.]cloud, an attacker-controlled domain unrelated to the project. CloudSEK has published the dataset as a public lookup, searchable by name or domain and filterable by confidence, with each row giving an organization's name and domain, a count of secrets exposed, a count of runs, and a label reading High or Medium. NVIDIA, Cisco, Deloitte, Volkswagen, FedEx, Siemens, and X Corp are among the entries.

A high-confidence match asserts whose systems each file came from, keying on identity signals in the captured CI runner environment, chiefly host identity and legitimate committer domains, and the organization's own domain has to appear before a match earns the top rating, according to CloudSEK. Repository namespaces support only a medium-confidence call. The FBI warned in a July 2 advisory, FLASH-20260702-01, that affiliated actors are likely to weaponize credentials exfiltrated during the TeamPCP campaign long after the initial compromise. "Attribution inside the dataset runs through two independent checks," CloudSEK said. "An index assigns each file using CI identity variables, and a separate ownership gate re-derives ownership from the fetched logs and can override that assignment. If they disagree, the report is withheld," and the final verdict takes the lower of the two confidence levels.

The LiteLLM incident sits inside a wider TeamPCP supply-chain campaign linked to Aqua Security's Trivy scanner, which Google tracks as UNC6780. Aqua said attackers retained access after an incomplete credential rotation and, on March 19, force-pushed malicious commits to 76 of 77 trivy-action version tags and all seven setup-trivy tags while publishing a malicious Trivy 0.69.4 release. The ecosystem compromise is tracked as CVE-2026-33634, added to CISA's Known Exploited Vulnerabilities catalog on March 26. That behavior inverts the usual triage question: whether a team knowingly uses LiteLLM matters less than whether anything on the host installed it, and the project's advisory notes that an unpinned transitive dependency, including one pulled in by an agent framework or orchestration tool, could deliver it without anyone choosing it. The campaign's downstream impact is confirmed even if CloudSEK's scale figures aren't. Checkmarx said credentials obtained through the Trivy attack enabled unauthorized access to its GitHub repositories and the publication of malicious artifacts, Mercor said it was affected by malicious LiteLLM versions and contained unauthorized activity, and CERT-EU separately assessed with high confidence that a European Commission AWS account was compromised through the Trivy supply-chain attack, with about 91.7 GB of compressed data exfiltrated.

Organizations assessing exposure should check for LiteLLM 1.82.7 or 1.82.8 installations during LiteLLM's March 24 audit window of 10:39 to 16:00 UTC, rotate any secrets those systems could access, and search their GitHub organizations for repositories named tpcp-docs or docs-tpcp, which the FBI lists as campaign indicators. A long-lived secret copied during that window — a static cloud key, an SSH key, or a publishing token — remains usable unless it has since been rotated or revoked, which is why the bureau's guidance is scoped to credentials rather than to the package, and why both it and Aqua tell teams to move away from long-lived tokens toward temporary ones. Both CloudSEK and LiteLLM tell affected parties to rotate rather than wait for proof that stolen credentials were used. The transitive nature of modern dependency chains means organizations can no longer rely on inventories of direct imports alone, and the automation that speeds development also accelerates the radius of compromise when a single publishing token falls into hostile hands.