Malicious LiteLLM Releases Target Credentials in Supply-Chain Attack
Summary
Malicious LiteLLM 1.82.7 and 1.82.8 releases on PyPI contained code designed to steal credentials and install a persistent downloader. Impact is unknown; researchers suspect a compromised maintainer account and link the activity to self-identified TeamPCP.
Key points
- Malicious LiteLLM versions 1.82.7 and 1.82.8 were published to PyPI and reportedly remained available for at least two hours on March 24.
- The packages contained code designed to extract cloud credentials, API keys, and cryptocurrency wallets, and to install a persistent downloader.
- How the releases were published is unclear; researchers consider a compromised maintainer account likely because valid publishing access was used.
- A researcher said the malware contacted its command endpoint every 50 minutes; some server responses contained only a YouTube song link.
- Wiz estimated LiteLLM was present in roughly 36% of cloud environments, but the number of affected organizations is unknown and widespread exploitation has not been publicly confirmed.
- Users were advised to treat credentials exposed in affected environments as potentially compromised.
- Researchers linked the incident to a campaign claimed by a group calling itself TeamPCP; the group’s broader claims remain unverified.
Article Details
- Victim Organization
- Organizations using LiteLLM
- Incident Type
- Software supply-chain compromise involving malicious LiteLLM package versions published to PyPI
- Data Types Exposed
- Cloud credentials (targeted for exfiltration; actual theft is unconfirmed)
- API keys (targeted for exfiltration; actual theft is unconfirmed)
- Cryptocurrency wallets (targeted for exfiltration; actual theft is unconfirmed)
- Affected Records
- Unknown
- Affected Data Size
- Unknown
- Operational Impact
- Malicious LiteLLM versions 1.82.7 and 1.82.8 were available on PyPI for at least two hours and may have been downloaded into development and cloud environments. The malware was designed to install a persistent downloader. The number of affected organizations and any widespread exploitation were not publicly confirmed.
- Ransom Or Extortion
- None reported
- Claim Status
- confirmed
MITRE ATT&CK
People
Adam ReynoldsSenior security researcher at Sonatype; discussed the malware's behavior, including its periodic contact with a command endpoint and potential downstream risks.Benjamin ReadDirector of strategic threat intelligence at Wiz; commented on the campaign's potential to enable further compromise through widely used tools.