Supply Chain Attacks in 2026: Inside the LiteLLM Malware That Targeted AI Developer Infrastructure
LiteLLM is downloaded roughly 3 million times a day. On March 24, 2026, two of those versions were backdoored with a three-stage credential-harvesting payload. Here's the complete breakdown of the attack and what every developer needs to change.
A developer's machine froze hard on March 24, 2026. Not the usual IDE slow-down, not a browser with too many tabs. We're talking complete system unresponsiveness — htop taking ten seconds to load, CPU pinned at 100 percent, memory exhausted. Callum McMahon at FutureSearch investigated, found what looked like a fork bomb consuming every available process slot, and traced it back to a Python package his environment had just updated.
That accidental discovery, sparked by a bug in the malware itself, is the reason the broader developer community found out about the LiteLLM supply chain attack at all. Without that bug, the credential harvester would have run silently. The damage would have been much larger than what was ultimately documented.
What LiteLLM Is and Why Attackers Wanted It
LiteLLM is a Python library that functions as a universal gateway for large language model API calls. It provides an OpenAI-style interface to more than 2,000 models across over 100 providers — OpenAI, Anthropic, Google, Azure, Hugging Face, and dozens more. Developers use it for A/B testing models, building failover redundancy into agentic applications, and managing API costs across providers with unified logging.
In practical terms, it sits at the center of AI infrastructure for a significant fraction of production AI applications. Zscaler's ThreatLabz puts its download count at roughly 3.4 million per day. Okta's threat intelligence team noted that LiteLLM is present in approximately 36 percent of cloud environments — meaning even organizations that don't directly use it may have it as a transitive dependency pulled in by other packages they do use.
That centrality is exactly what made it a high-value target. A library sitting in the middle of AI infrastructure, handling API keys for every major model provider, accumulates credentials at scale. Compromising it doesn't require compromising any specific target. It compromises everyone who installs the update.
The Attack Chain: From Trivy to LiteLLM
This attack didn't start with LiteLLM. It started five days earlier, on March 19, with a tool called Trivy — an open-source vulnerability scanner widely used in CI/CD pipelines.
The threat group behind both attacks, tracked by researchers as TeamPCP, rewrote Git tags in the trivy-action GitHub Action repository to point to a malicious release (v0.69.4) carrying a credential-harvesting payload. Every automated CI/CD pipeline that ran a Trivy security scan on March 19 or later inadvertently executed TeamPCP's code and potentially leaked its secrets.
On March 23, the same infrastructure was used in a parallel attack on Checkmarx KICS (Keep Infrastructure as Code Secure), a static analysis tool also common in developer security pipelines.
On March 24, LiteLLM's own CI/CD pipeline ran Trivy as part of its build process — pulling the compromised action without a pinned version. The compromised Trivy action exfiltrated LiteLLM's PyPI publishing token from the GitHub Actions runner environment. TeamPCP then used that token to publish two backdoored versions of LiteLLM directly to PyPI: versions 1.82.7 at 10:39 UTC, and 1.82.8 at 10:52 UTC.
The malicious packages were live for approximately three to five hours before PyPI quarantined them — but LiteLLM's daily download volume meant tens of thousands of installs happened in that window. The attackers claim to have exfiltrated over 300GB of data during the exposure period.
What the Malware Actually Did
Trend Micro, which published a detailed technical analysis on March 26, described a three-stage payload architecture.
The first stage used a Python .pth file (litellm_init.pth) deposited into the Python site-packages directory. Python's .pth mechanism executes code on every Python interpreter startup — meaning the payload ran every time any Python process started on an infected machine, not just when LiteLLM was explicitly imported.
The second stage performed exhaustive credential harvesting. The malware walked the filesystem looking for .env, .env.local, .env.production, and .env.staging files across up to six directory levels. It harvested AWS credentials, GCP tokens, Azure keys, Kubernetes service account secrets, SSH private keys, Git credentials, database connection strings, CI/CD pipeline configurations, and API keys for every major cloud provider and AI service. Collected data was encrypted and exfiltrated via POST requests to models.litellm[.]cloud — a domain designed to look like legitimate LiteLLM infrastructure.
The third stage targeted Kubernetes environments. If a Kubernetes service account token was present, the malware read all cluster secrets across all namespaces and attempted to create a privileged container on every node in kube-system, mounting the host filesystem and installing a persistent systemd backdoor at a hidden path. This backdoor would survive package removal and beacon to TeamPCP's C2 infrastructure for secondary payloads.
The fork bomb behavior that exposed the attack was actually a bug: the .pth launcher spawned a child process that re-triggered the .pth file, which spawned another child process, creating exponential recursion. Andrej Karpathy noted publicly that without this implementation error, the malware would have gone undetected far longer.
The Blast Radius and Immediate Response
LiteLLM's team responded quickly. Within hours of the community's discovery, they suspended all new releases, rotated credentials, and engaged external incident response. By March 25, a clean v1.83.0 had been published through a rebuilt CI/CD pipeline with isolated environments, stronger security gates, and hardened release separation.
Organizations affected were those that installed or upgraded LiteLLM via pip between 10:39 UTC and approximately 16:00 UTC on March 24 without pinning a specific version. Anyone who received 1.82.7 or 1.82.8 should treat every credential that machine had access to as compromised: rotate all API keys, cloud access tokens, SSH keys, database passwords, and CI/CD secrets immediately. Audit Kubernetes cluster access logs for the infection window.
What Every Developer Should Change Right Now
The LiteLLM attack is the clearest possible demonstration of what happens when developer security assumptions meet a determined, sophisticated attacker. Pin your dependency versions. Always. An unpinned pip install litellm grabs the latest version — which on March 24 was malware.
Scan dependencies before they reach your machines. Tools like Snyk, Cycode, and the open-sourced who-touched-my-packages scanner from Point Wild can flag compromised packages before installation.
Treat .env files as secrets, not configuration. Developers have normalized storing API keys in plaintext .env files. This attack specifically targeted them. Move to secrets management systems — HashiCorp Vault, AWS Secrets Manager, Azure Key Vault — that never expose credentials in filesystem-readable files.
And extend your zero trust posture to your supply chain. The trust you extend to a package because it comes from a known source is exactly what attackers are exploiting. Assume that trust has limits.
Threat Intelligence Snapshot
Last updated: August 25, 2026
Active threat
security
This in-depth threat intelligence report covers the latest security research, attack vectors, and mitigation strategies. Read the full analysis below for detailed recommendations and real-world implications.