In brief: Two manipulated LiteLLM versions on PyPI stole credentials and tokens for 40 minutes, affecting over 2,500 organizations according to CloudSEK – part of the TeamPCP supply chain campaign (CVE-2026-33634) with confirmed downstream damage at Checkmarx and the European Commission.
In late March 2026, two manipulated versions of the AI gateway LiteLLM were published on PyPI, which harvested credentials and tokens. CloudSEK attributes the incident to a supply chain campaign by the group TeamPCP (UNC6780), which is said to have affected over 2,500 organizations – including NVIDIA, Cisco, Deloitte, Volkswagen, FedEx, and Siemens.
The compromised LiteLLM versions 1.82.7 and 1.82.8 were published on the PyPI package registry. LiteLLM serves as an AI gateway for connecting various language models and is accordingly widely used in development environments. The manipulated packages were active for around 40 minutes before PyPI placed them under quarantine. Via a file named litellm_init.pth, the malicious code was automatically executed at every start of a Python process – regardless of whether the library was explicitly imported in the respective script. The malware specifically read out environment variables, including API keys such as OPENAI_API_KEY and ANTHROPIC_API_KEY, SSH keys, Kubernetes tokens, cloud credentials, and database passwords, and transmitted the intercepted data encrypted to the attacker-controlled domain models.litellm[.]cloud.
The security firm CloudSEK analyzed a dataset of around 434,000 intercepted log and loot files and attributed the data to over 2,500 organizations, including NVIDIA, Cisco, Deloitte, Volkswagen, FedEx, and Siemens. The attribution was based on identity signals from CI/CD pipelines such as host IDs and developer domains. The incident is part of a broader supply chain campaign by the attacker group TeamPCP (tracked by Google as UNC6780), tracked under the identifier CVE-2026-33634. As part of the same wave, releases of the security software Trivy were also compromised. The FBI warned in a security advisory that stolen credentials can be abused long after the actual breach.
For CISOs, the incident is relevant because it shows how a single compromised dependency in a widely used AI infrastructure component can systematically harvest secrets across CI/CD pipelines without requiring explicit code execution by developers. The practical impact has already been confirmed: at Checkmarx, the stolen credentials led to unauthorized access to GitHub repositories. CERT-EU also found that around 91.7 GB of compressed data was exfiltrated from an AWS account of the European Commission via the attack on the Trivy supply chain.
Security experts and investigative authorities recommend that affected teams check systems for installations of LiteLLM 1.82.7 or 1.82.8 within the time window of March 24, 2026 (10:39 to 16:00 UTC), rotate all credentials, API keys, SSH keys, and publishing tokens that were accessible from the affected systems, and search their own GitHub organizations for suspicious repositories with name prefixes such as tpcp-docs or docs-tpcp, which were created by the malware for data exfiltration.
Source: www.it-daily.net · Published August 13, 2026
Lumi AI News — AI-assisted curation pursuant to Art. 50 EU AI Act. Paraphrasing and classification by Lumi News Pipeline v1.8.3.