In March, two malicious releases of the **LiteLLM** library, versions 1.82.7 and 1.82.8, were live on **PyPI** for approximately 40 minutes. These compromised packages contained credential-stealing code designed to harvest critical secrets from systems upon installation. ### Widespread Exposure Revealed by CloudSEK Threat intelligence firm **CloudSEK** has now published a dataset, built from roughly 434,000 captured files, indicating potential exposure for more than 2,500 organizations. While this figure doesn't represent a confirmed victim count, it highlights the broad reach of the campaign, known as **TeamPCP**. **CloudSEK** confirmed that the material originated from confidential intelligence sources, consisting of captured loot and log files deemed part of the attack. The firm has made a [public lookup](https://exposure.cloudsek.com/ai-supply-chain-incident) available, allowing organizations to search by name or domain and filter by confidence level. High-confidence matches are based on identity signals within captured CI runner environments, including host identity and legitimate committer domains. Medium-confidence matches are assigned based on repository namespaces. Notable entries in the dataset include **NVIDIA**, **Cisco**, **Deloitte**, **Volkswagen**, **FedEx**, **Siemens**, and **X Corp**. It's crucial to understand that inclusion in this dataset does not confirm credential misuse. Both **CloudSEK** and **LiteLLM** strongly advise affected parties to rotate potentially exposed credentials proactively.  ### The LiteLLM Incident Details **LiteLLM** is an open-source AI gateway that facilitates connections between applications and various model providers. The project identified versions 1.82.7 and 1.82.8 as compromised, noting they were available on March 24th from 10:39 UTC for approximately 40 minutes before **PyPI** quarantined them. Users are advised to treat any installation on that day up to 16:00 UTC as suspect. As of August 12th, these versions are no longer present in the package's release history. The malicious packages were engineered to collect environment variables, SSH keys, cloud credentials, Kubernetes tokens, and database passwords. This stolen data was then encrypted and transmitted to `models.litellm[.]cloud`, an attacker-controlled domain unrelated to the legitimate **LiteLLM** project. Notably, version 1.82.8 included a file named `litellm_init.pth`. This Python process executes at interpreter startup, meaning the malicious code would run whenever a Python process initiated in that environment, irrespective of whether **LiteLLM** was explicitly imported. ### Broader TeamPCP Campaign and FBI Warning This **LiteLLM** incident is part of a larger **TeamPCP** supply-chain campaign, which **Google** tracks as **UNC6780**. The campaign has also been linked to **Aqua Security's Trivy** scanner. The **FBI** issued an advisory (FLASH-20260702-01) in July, warning that threat actors are likely to weaponize exfiltrated credentials from the **TeamPCP** campaign long after the initial compromise. The **FBI** and **Aqua Security** recommend organizations rotate CI/CD secrets, publishing tokens, and cloud credentials exposed during the relevant windows. They also advocate for transitioning from long-lived tokens to temporary ones.  The ecosystem compromise is officially tracked as **CVE-2026-33634**, which was added to **CISA's Known Exploited Vulnerabilities catalog** on March 26th. The **CVE** record now explicitly lists **BerriAI LiteLLM** 1.82.7 through 1.82.8 as affected, alongside the **Trivy** components. ### Attack Chain Discrepancy Clarified Initial reports from **CloudSEK**, **LiteLLM**, and **Unit 42** offered slightly different accounts of how the malicious **LiteLLM** releases reached **PyPI**. **CloudSEK** suggested a poisoned build, **LiteLLM** pointed to a direct **PyPI** upload bypassing its CI/CD, and **Unit 42** described attackers targeting **PyPI** publishing tokens after the **Trivy** breach. **CloudSEK** clarified that these are not competing explanations but rather different stages of the same attack chain. Their evidence covers credential acquisition, while **LiteLLM** and **Unit 42** focused on how those credentials were subsequently used. The **PyPA's** advisory for the malicious releases corroborates this, detailing a sequence where an API token exposed through a compromised **Trivy** dependency was then used to upload the two malicious **LiteLLM** versions.  ### Confirmed Downstream Impact The downstream impact of the **TeamPCP** campaign is already confirmed. **Checkmarx** reported that credentials obtained via the **Trivy** attack led to unauthorized access to their GitHub repositories and the publication of malicious artifacts. **Mercor** also confirmed being affected by malicious **LiteLLM** versions and has contained unauthorized activity. Separately, **CERT-EU** assessed with high confidence that a **European Commission AWS** account was compromised through the **Trivy** supply-chain attack, resulting in the exfiltration of approximately 91.7 GB of compressed data. Organizations should diligently assess their exposure and implement robust credential rotation policies, especially for long-lived tokens, to mitigate ongoing risks from this pervasive campaign.