The Full Story of the LiteLLM Supply Chain Attack
On March 24, 2026, while AI developers were still coding, the Python library LiteLLM on PyPI was quietly “poisoned.”
The open-source Python library LiteLLM, with a monthly download volume of up to 97 million, had its PyPI repository maliciously tampered with during the early morning hours. Two contaminated versions (1.82.7 and 1.82.8) were silently released. Within just three hours, tens of thousands of development environments and enterprise systems may have been exposed to data leakage risks. Unlike ordinary attacks, this incident was not an isolated malicious injection but a chain attack meticulously orchestrated by the hacker group TeamPCP.
SlowMist’s self-developed Web3 threat intelligence and dynamic security monitoring tool, MistEye, promptly delivered related threat intelligence alerts to affected clients:
Attack Overview
The root cause of the LiteLLM attack was not a vulnerability in the library itself, but rather that the open-source security scanner Trivy used in its CI/CD pipeline had already been compromised.
Attack Timeline:
- March 19: TeamPCP tampered with the Trivy GitHub Action tags, injecting malicious code.
- March 23: The attackers breached the Checkmarx KICS security scanning tool, paving the way for the next stage of the attack.
- March 24: When LiteLLM’s CI/CD pipeline ran the compromised Trivy, the PyPI release token was stolen. The attackers used this to bypass the normal release process, pushing two malicious versions directly to PyPI, thereby “poisoning” a core AI dependency library.
The exposure of this attack was quite dramatic — the attackers had intended to remain stealthy, but an oversight in their malicious code caused it to backfire. In version 1.82.8, the injected litellm_init.pth file would automatically execute every time a Python process started and repeatedly trigger itself via subprocesses, directly causing memory exhaustion and crashes on the test machines of FutureSearch engineers. This unintended flaw is what brought the attack to light earlier than planned, which otherwise could have remained dormant for days or even weeks, with potentially disastrous consequences.
The malicious code designed by TeamPCP for LiteLLM adopts a staged execution strategy, featuring strong stealth, wide impact scope, and capabilities for persistence and lateral movement — far exceeding the damage level of typical supply chain attacks.
The first stage focuses on information collection. The malicious script systematically scans all sensitive data on the infected host, covering an extensive range: from developers’ SSH private keys, Git configurations, and shell history, to enterprise cloud provider (AWS/GCP/Azure) credentials, Kubernetes configurations, database passwords, and even cryptocurrency wallet files and mnemonic phrases.
Notably, as a gateway for unified access to various large model APIs, LiteLLM often stores API keys from multiple model providers. Once compromised, it effectively opens the door to an enterprise’s AI infrastructure directly to the attacker.
The second stage involves encrypted exfiltration. All collected data is encrypted using the AES-256-CBC algorithm, with the session key protected by a 4096-bit RSA public key. The data is then packaged into a tar archive and sent to an attacker-controlled spoofed domain, models.litellm.cloud.
This domain was registered just one day before the attack and has no association with LiteLLM’s official infrastructure, making it highly deceptive. According to disclosures, the attackers exfiltrated approximately 300GB of compressed credentials through this operation, involving around 500,000 sensitive credentials.
The third stage involves persistence and lateral movement, which is also the most dangerous consequence of this attack. On local machines, the malicious code creates a backdoor script named sysmon.py in the user directory and establishes persistence through a systemd service. Even if LiteLLM is uninstalled, the backdoor may continue running.
If a Kubernetes environment is detected, the attacker leverages service account tokens to deploy privileged Pods across all nodes in the cluster, enabling full network propagation and escalating a single host compromise into a cluster-wide security crisis.
The attackers also attempted to cover their tracks by using malicious bots to flood messages and by hijacking maintainer accounts to close GitHub issues.
Potential Risks
At present, PyPI has removed the affected versions, and the quarantine has been lifted. LiteLLM maintainers are handling follow-up actions. However, the aftermath of this attack is far from resolved, and its potential impact may continue to surface over the coming weeks or even months.
First is the challenge of removing persistent backdoors. Since the malicious code achieves persistence through systemd services and hidden directories, some users may assume the risk is eliminated after uninstalling LiteLLM, unaware that the backdoor may still be running in the background, collecting data and awaiting instructions. This kind of “stealthy infection,” if overlooked, could lead to continuous leakage of sensitive data and leave an entry point for further attacker intrusion.
Second is the chain reaction caused by credential leakage. The 500,000 stolen credentials span critical areas such as enterprise cloud services, databases, and CI/CD pipelines. These credentials may be used by attackers to further compromise other systems, creating a “domino effect.”
Finally, there is the risk of dependency chain propagation. As a core dependency in the AI ecosystem, LiteLLM is referenced by more than 2,000 packages, including DSPy, MLflow, and Open Interpreter. Many developers may have never installed LiteLLM directly, but indirectly introduced the malicious version through other tools. This type of “unintentional infection” has a very wide reach, and some outdated containers or unpatched CI/CD pipelines may still contain compromised dependencies, posing long-term security risks.
The LiteLLM attack inevitably brings to mind the Trust Wallet security incident — where version 2.68 of a mainstream cryptocurrency wallet browser extension was implanted with a backdoor, leading to large-scale theft of user funds. The root cause of that incident was not third-party package tampering, but direct modification of the extension’s internal code, leveraging the PostHog JS analytics platform to redirect user data to a malicious server.
In the LiteLLM attack, cryptocurrency wallet files and mnemonic phrases were likewise included in the scope of data exfiltration. Moreover, the attackers demonstrated capabilities for long-term persistence and lateral movement. If cryptocurrency developers and holders fail to conduct timely investigations, they may repeat the same mistake and face the risk of asset theft.
Beyond that, if enterprises fail to promptly rotate cloud credentials and database passwords, it may lead to leakage of core business data and full system compromise, with economic losses and reputational damage that are difficult to quantify.
In fact, the TeamPCP group had previously publicly mocked security vendors for “failing to protect even their own supply chains,” and claimed plans to steal commercial secrets over the long term. The LiteLLM attack is just one part of its broader, systematic infiltration of the open-source ecosystem.
This also serves as a warning to all developers and enterprises: supply chain security has become a critical risk that cannot be ignored. Any negligence in any link may lead to devastating consequences.
Incident Response
In the face of this attack and its aftermath, both individual developers and enterprises must take immediate action to investigate risks, eliminate hidden threats, and prevent further losses:
1. Immediately check for infection
Use the following command to check the version. If it is 1.82.7 or 1.82.8, uninstall immediately:
pip show litellm
Use the following command to clear the package manager cache:
rm -rf ~/.cache/uv or pip cache purge
2. Fully rotate sensitive credentials
Assume that all credentials in affected environments have been compromised. Immediately rotate SSH keys, cloud provider credentials, database passwords, API keys, etc. In particular, for cryptocurrency wallets (private keys and mnemonic phrases), assets should be transferred immediately and keys replaced.
3. Standardize dependency management
In the long term, dependency versions should be pinned (it is recommended to lock LiteLLM to version 1.82.6 or earlier safe versions), and avoid using unspecified versions. At the same time, strengthen CI/CD pipeline security, audit and update compromised security tools, and prevent attackers from exploiting them again.
Conclusion
The LiteLLM supply chain attack not only exposes the fragility of the open-source ecosystem, but also reminds us that in today’s rapidly evolving AI landscape, the security of core dependency libraries directly impacts the stability of the entire ecosystem. Only by taking supply chain security seriously, promptly identifying risks, and improving defense mechanisms can we avoid similar major losses and safeguard our data and assets.
About SlowMist
SlowMist is a threat intelligence firm focused on blockchain security, established in January 2018. The firm was started by a team with over ten years of network security experience to become a global force. Our goal is to make the blockchain ecosystem as secure as possible for everyone. We are now a renowned international blockchain security firm that has worked on various well-known projects such as HashKey Exchange, OSL, MEEX, BGE, BTCBOX, Bitget, BHEX.SG, OKX, Binance, HTX, Amber Group, Crypto.com, etc.
SlowMist offers a variety of services that include but are not limited to security audits, threat information, defense deployment, security consultants, and other security-related services. We also offer AML (Anti-money laundering) software, MistEye (Security Monitoring), SlowMist Hacked (Crypto hack archives), FireWall.x (Smart contract firewall) and other SaaS products. We have partnerships with domestic and international firms such as Akamai, BitDefender, RC², TianJi Partners, IPIP, etc. Our extensive work in cryptocurrency crime investigations has been cited by international organizations and government bodies, including the United Nations Security Council and the United Nations Office on Drugs and Crime.
By delivering a comprehensive security solution customized to individual projects, we can identify risks and prevent them from occurring. Our team was able to find and publish several high-risk blockchain security flaws. By doing so, we could spread awareness and raise the security standards in the blockchain ecosystem.
