The single most consequential security story of 2026 is not a zero-day in a browser, a ransomware gang encrypting a hospital, or an AI agent escaping its sandbox. It is a 40-minute window on the Python Package Index. On March 24, 2026, a threat group tracked as TeamPCP uploaded two malicious versions of LiteLLM — versions 1.82.7 and 1.82.8 — to PyPI. The packages were live for approximately 40 minutes before they were identified and pulled. In that window, roughly 47,000 downloads carried credential-stealing malware into developer environments, CI/CD runners, and production AI infrastructure across the world.
The downstream damage, quantified in a CloudSEK analysis published in August 2026, is staggering: over 2,500 organizations and 434,000 CI/CD pipelines were potentially exposed. CloudSEK called it the largest supply-chain attack targeting AI infrastructure identified so far in 2026. The incident was assigned CVE-2026-33634 with a CVSS 4.0 score of 9.4 — near-maximum severity. And the reason it matters goes well beyond LiteLLM itself: it exposed a structural weakness in how the AI engineering world consumes open-source dependencies, where a single compromised package can cascade into thousands of production systems because every AI gateway, every LLM proxy, and every agent framework pulls from the same unauthenticated package registry.
What LiteLLM Is and Why It Was a High-Value Target
LiteLLM is an open-source Python library and proxy server that provides a unified interface to over 100 LLM providers — OpenAI, Anthropic, Google, AWS Bedrock, Azure, Cohere, Mistral, local vLLM endpoints, and dozens more. It is the connective tissue of a large fraction of the AI application stack. If you are building an application that calls multiple LLM APIs, routing requests through LiteLLM is the standard pattern: it handles authentication, rate limiting, cost tracking, fallbacks, and load balancing across providers. The package averages around 3.4 million daily downloads. It is embedded inside AI gateways, agent frameworks, RAG pipelines, and internal ML platforms at companies ranging from startups to hyperscalers.
That ubiquity is exactly what made it a high-value target. Compromising LiteLLM is not compromising one application — it is compromising the credential path for every LLM API key that flows through it. And because LiteLLM is typically deployed as a proxy that holds the API keys for upstream providers, a single malicious version could exfiltrate the keys that unlock an organization's entire AI spending budget. Worse, LiteLLM is commonly installed inside CI/CD pipelines for testing and deployment, meaning the compromise reached environments that also hold cloud credentials, database connection strings, and source-code repository tokens. TeamPCP understood this. The attack was not opportunistic. It was designed to weaponize the AI supply chain's most trafficked chokepoint.
The Attack Chain: How 40 Minutes Became 434,000 Pipelines
According to Kaspersky's analysis of the campaign, the attack did not begin with LiteLLM. TeamPCP first compromised the CI/CD infrastructure used to build and publish several developer-tooling projects — including Aqua Security's Trivy scanner and Checkmarx's KICS — and used that foothold to steal PyPI publishing credentials. With the credentials in hand, they pushed trojanized versions of multiple packages. The LiteLLM trojan was the highest-impact payload: the malicious code was embedded in the proxy_server.py file, and version 1.82.8 additionally contained a malicious litellm_init file that auto-executed whenever Python started. The stolen data was exfiltrated to an attacker-controlled server at the domain models.litellm[.]cloud — a typosquat that lent the exfiltration endpoint an air of legitimacy.
The malware's job was credential theft. It scraped environment variables, cloud credential files (~/.aws/credentials, ~/.config/gcloud), Kubernetes secrets mounted in pods, database connection strings, LLM API keys, and npm/PyPI publish tokens — then exfiltrated them. The reason a 40-minute window produced such a large blast radius is the mechanics of CI/CD caching and automated dependency resolution. When a new package version appears on PyPI, automated pipelines running pip install litellm or pip install --upgrade litellm pull the latest version by default. Within minutes, the poisoned versions were pinned in lockfiles, cached in Docker layers, and baked into container images. Those images then propagated into production deployments, staging environments, and downstream builds. A package that was live for 40 minutes kept exfiltrating credentials from systems that rebuilt weeks later, because the malicious version was now baked into cached layers and pinned lockfiles that nobody reviewed.
CloudSEK's blast-radius analysis traced this propagation chain. The 434,000 pipeline figure is not 434,000 direct downloads — it is the estimated number of CI/CD pipelines that ran builds containing the compromised package, either directly or transitively through dependent packages and container images. The 2,500+ company figure is derived from CloudSEK's exposure intelligence correlating the malicious package hashes and the exfiltration endpoint across observed infrastructure. The FBI, per reporting from TechJuice, warned that the threat remains live: credentials stolen in March may still be valid and may still be used for follow-on access months after the original 40-minute window closed.
The Six CVEs: Beyond the Supply Chain Compromise
The supply chain compromise is the headline, but it is not the only LiteLLM vulnerability disclosed in 2026. A separate analysis cataloged six CVEs affecting LiteLLM during the year, including remote code execution, SQL injection, and privilege escalation in addition to the supply chain attack. The RCE vulnerability is particularly relevant for any team running the LiteLLM proxy server exposed to the network: an attacker who can reach the proxy can exploit the RCE to execute arbitrary code on the host, which means the proxy that was supposed to protect your LLM API keys becomes the entry point to the machine that holds them.
This pattern — a widely deployed AI infrastructure component accumulating serious CVEs across multiple classes — is the deeper story. The AI engineering world has adopted open-source dependencies at a speed that has outpaced the maturity of those dependencies. LiteLLM is not uniquely insecure; it is representative. The same dynamic applies to LangChain, LlamaIndex, AutoGPT-style agent frameworks, and the dozens of MCP (Model Context Protocol) servers now being plugged into coding assistants. The attack surface is growing faster than the hardening, and attackers have noticed. TeamPCP's campaign was sophisticated, but the underlying methodology — compromise a CI/CD scanner, steal publish credentials, push a trojanized version — is repeatable against any package with a similar trust position.
What Every AI Engineering Team Must Do Now
If your organization uses LiteLLM, or any LLM gateway, agent framework, or AI-adjacent open-source dependency, the LiteLLM incident is your playbook for what to check and what to fix. The following steps are prioritized by urgency.
1. Determine whether you ran the compromised versions. The last safe version of LiteLLM is 1.82.6. Versions 1.82.7 and 1.82.8 are compromised. Audit your lockfiles (requirements.txt, poetry.lock, Pipfile.lock), your Docker image layer history, and your CI/CD build logs for any reference to these versions. If you find them, treat the incident as an active breach: the malware exfiltrated credentials from the environment where the package ran.
2. Rotate every credential that was present in any environment that ran the compromised package. This is the hard part, because the malware scraped a broad credential surface. Rotate AWS access keys, GCP service account keys, Azure client secrets, database passwords, LLM API keys (OpenAI, Anthropic, Google, etc.), Kubernetes secrets, npm and PyPI publish tokens, and any CI/CD provider secrets (GitHub tokens, GitLab tokens, Buildkite tokens). Do not assume that because the package was pulled after 40 minutes, credentials are safe — the exfiltration happened on first execution, and cached images continued to execute the malicious code on every rebuild.
3. Pin dependencies and verify checksums. Floating version specifiers (litellm with no version, or litellm>=1.82) are how this attack propagated so fast. Pin every AI dependency to an exact version in a lockfile, and verify package hashes at install time. PyPI publishes SHA-256 hashes for every release; pip install --require-hashes will refuse to install a package whose hash does not match the lockfile. This would have blocked the LiteLLM trojan in every environment that used hash verification, because the malicious versions had different hashes from 1.82.6.
4. Audit your AI supply chain for single points of failure. LiteLLM was a high-value target because it is a chokepoint: many systems depend on it, and it holds many credentials. Map the same dependency for every AI component you use. Which package holds your LLM API keys? Which one has access to your vector database? Which one can execute code in your production environment? Each of those is a target, and each needs the same pinning, hash verification, and credential-isolation treatment.
5. Isolate AI proxy credentials from CI/CD credentials. One reason the LiteLLM blast radius was so large is that the package ran in CI/CD environments that also held build and deploy credentials. An AI gateway proxy should hold only LLM API keys, in an isolated secrets scope that cannot read cloud credentials or deploy tokens. If the proxy is compromised, the attacker gets LLM keys — expensive, but not "full production access" expensive. The principle of least privilege is not new, but AI infrastructure deployments have been routinely violating it by running proxies in broad-credential CI/CD runners.
6. Harden authentication for the systems that survived. Once credentials are rotated, ensure that the rebuilt systems use phishing-resistant authentication. FIDO2 security keys for human administrators, short-lived workload identities (not long-lived tokens) for service-to-service authentication, and signed commit verification for any code that touches the AI supply chain. The LiteLLM attack began with stolen publish credentials; signed publishing and short-lived credentials would have made the initial CI/CD compromise significantly harder to weaponize.
The Bigger Picture: AI Infrastructure Is the New Supply Chain Frontier
The LiteLLM attack is best understood as the AI-infrastructure analogue of the SolarWinds compromise, but with two important differences that make the AI version harder to defend. First, the dependency graph is denser. A typical AI application pulls dozens of open-source packages from PyPI and npm, each of which may transitively pull dozens more. The attack surface is not one vendor — it is an entire ecosystem of packages that are installed by default, rarely audited, and frequently updated by automated pipelines. Second, the velocity is higher. AI engineering moves at a pace where a new package version can be released, adopted by thousands of CI/CD pipelines, and baked into production images within hours. The 40-minute PyPI window is the extreme case, but the underlying dynamic — rapid adoption of unverified dependencies — is the norm.
The response from the ecosystem has been mixed. PyPI has accelerated its rollout of mandatory two-factor authentication for package maintainers and is piloting signed package publishing, both of which would have blocked the specific credential-theft vector TeamPCP used. The Open Source Security Foundation (OpenSSF) has published AI-specific supply-chain guidance that extends SLSA (Supply-chain Levels for Software Artifacts) provenance to ML model and package distribution. But adoption is lagging. Most AI engineering teams do not verify package signatures, do not pin hashes, and do not isolate AI proxy credentials from build credentials. Until those practices become default, the next LiteLLM is a matter of when, not if.
For teams building on local LLM inference hardware or cloud LLM APIs, the lesson is the same: the trust chain is only as strong as its weakest package. The AI era has made every Python package a potential credential exfiltration endpoint, and every CI/CD pipeline a potential propagation vector. The LiteLLM attack proved that 40 minutes is enough. The question for every AI engineering team is whether the next 40 minutes will find you already hardened, or still running pip install --upgrade on a floating version specifier. Rotate your keys. Pin your hashes. Isolate your credentials. The supply chain is the attack surface now, and the AI supply chain is the softest part of it.
Get weekly AI & security infrastructure guides
Join the GeniusTechLab newsletter for AI infrastructure breakdowns, security analysis, and hardware recommendations — one email a week, no spam.
Subscribe to the newsletter →