Malicious LiteLLM PyPI Releases May Have Exposed Over 2,100 Organizations in 40 Minutes
Two malicious releases of the popular AI gateway LiteLLM published on PyPI in March may have exposed data from more than 2,500 organizations. The malicious code embedded in versions 1.82.7 and 1.82.8 was available for download for about 40 minutes and could steal cloud keys, SSH keys, Kubernetes tokens, database passwords, and other secrets from systems where it was installed.
Threat intelligence firm CloudSEK obtained a dataset built from roughly 434,000 files captured by the attackers. According to their assessment, the potential impact spans more than 2,500 organizations. However, these figures are not an exact victim count: CloudSEK said the material came from confidential intelligence sources and consists of captured loot and log files attributed to the campaign, not data gathered from the organizations themselves.
CloudSEK published the dataset as a public lookup tool searchable by name or domain and filterable by confidence. Each entry includes an organization's name and domain, a count of exposed secrets, a count of runs, and a label reading High or Medium.
A high-confidence match asserts whose systems each file came from. That verdict keys on identity signals in the captured CI runner environment, chiefly host identity and legitimate committer domains, and the organization's own domain must appear before a match earns the top rating.
Repository namespaces support only a medium-confidence call. NVIDIA, Cisco, Deloitte, Volkswagen, FedEx, Siemens, and X Corp are among the entries, but none of that establishes that stolen credentials were used, which is why both CloudSEK and LiteLLM tell affected parties to rotate rather than wait for proof.
LiteLLM is an open-source AI gateway used to connect applications with multiple model providers. The project identified versions 1.82.7 and 1.82.8 as compromised and said they were live on March 24 from 10:39 UTC for about 40 minutes before PyPI quarantined them, though it tells users to treat any install that day up to 16:00 UTC as suspect.
The Hacker News confirmed via PyPI on August 12 that neither version appears in the package's release history, while 1.82.6 and 1.83.0 remain available.
The FBI warned in a July 2 advisory, FLASH-20260702-01, that affiliated actors are likely to weaponize credentials exfiltrated during the TeamPCP campaign long after the initial compromise. It told organizations to rotate CI/CD secrets, publishing tokens, and cloud credentials accessible during the relevant exposure windows. A long-lived secret copied during that window — a static cloud key, an SSH key, or a publishing token — remains a threat indefinitely.
