Malicious LiteLLM PyPI Packages Expose 2,500+ Organizations to Credential Theft

Attackers compromise AI gateway LiteLLM to steal credentials from over 2,500 global organizations. Two malicious versions (1.82.7 and 1.82.8) sat on PyPI for 40 minutes on March 24, scraping API keys, SSH keys, and Kubernetes tokens at Python interpreter startup. Threat intelligence firm CloudSEK mapped the potential exposure using roughly 434,000 captured files, identifying NVIDIA $NVDA, Cisco $CSCO, Deloitte, and Volkswagen among the affected namespaces. The breach stems from the broader TeamPCP supply-chain campaign, which previously hijacked Aqua Security’s Trivy scanner to obtain the initial publishing tokens used in this upload. CERT-EU confirmed a European Commission AWS account was compromised through the Trivy attack chain, resulting in about 91.7 GB of exfiltrated data. "These are different stages of the same attack chain, not competing explanations." — CloudSEK