LiteLLM Pulls Malicious Releases From 3 Repositories After Attack Injected Credential-Stealing Code
Updated
Updated · TechCrunch · Oct 21
LiteLLM Pulls Malicious Releases From 3 Repositories After Attack Injected Credential-Stealing Code
3 articles · Updated · TechCrunch · Oct 21
Summary
LiteLLM said an attacker inserted malicious code into releases published on PyPI, Docker Hub and GitHub Container Registry, then removed the affected packages and images.
The tainted artifacts carried an information stealer targeting cloud credentials, passwords and AI service keys, plus a remote-access trojan that could let attackers run commands on compromised systems.
LiteLLM urged anyone who installed the releases to follow its remediation guidance as security teams also dealt with newly patched high-severity flaws in PHP and Node.js.
The compromise added to a string of recent incidents — including TiDB Cloud, Plex2Shell and a BeyondTrust zero-day — underscoring how quickly defenders can be overwhelmed as AI speeds exploitation.
How did a compromised security scanner turn a popular open-source AI tool into a massive credential-stealing trojan overnight?
With AI uncovering critical flaws faster than ever, are defenders gaining the upper hand or just drowning in unpatchable alerts?
If major certificate authorities and upstream scanners are simultaneously compromised, can any enterprise truly trust its foundational digital infrastructure anymore?
The March 2026 LiteLLM PyPI Attack: TeamPCP’s Multi-Ecosystem Supply Chain Breach and Its Global Fallout
Overview
The LiteLLM supply chain attack began when TeamPCP exploited a misconfigured workflow in Aqua Security's Trivy scanner, stealing a bot token that was not fully revoked. Using this, they injected malicious code into Trivy, which was later pulled by LiteLLM’s build process. The compromised scanner harvested LiteLLM’s PyPI publishing token, letting attackers upload two backdoored releases. The second release used a Python startup file that triggered a fork bomb, causing system crashes and revealing the breach. The malware collected secrets and exfiltrated them, even breaking out of Kubernetes containers to persist on host systems. Quick community response limited the damage.