Bottom line: Two manipulated LiteLLM versions on PyPI stole credentials and tokens for 40 minutes, affecting more than 2,500 organizations according to CloudSEK – part of the TeamPCP supply chain campaign (CVE-2026-33634) with confirmed downstream damage at Checkmarx and the European Commission.
In late March 2026, two manipulated versions of the AI gateway LiteLLM were published on PyPI, capturing credentials and tokens. CloudSEK attributes the incident to the supply chain campaign of the group TeamPCP (UNC6780), which is said to have affected over 2,500 organizations – including NVIDIA, Cisco, Deloitte, Volkswagen, FedEx and Siemens.
The compromised LiteLLM versions 1.82.7 and 1.82.8 were published on the package repository PyPI. LiteLLM serves as an AI gateway for connecting various language models and is correspondingly widely used in development environments. The manipulated packages were active for around 40 minutes before PyPI quarantined them. Via a file named litellm_init.pth, the malicious code was automatically executed every time a Python process started – regardless of whether the library was explicitly imported in the respective script. The malware specifically read out environment variables, including API keys such as OPENAI_API_KEY and ANTHROPIC_API_KEY, SSH keys, Kubernetes tokens, cloud credentials and database passwords, and transmitted the intercepted data in encrypted form to the attacker-controlled domain models.litellm[.]cloud.
The security company CloudSEK analyzed a dataset of around 434,000 intercepted log and loot files and attributed the data to over 2,500 organizations, including NVIDIA, Cisco, Deloitte, Volkswagen, FedEx and Siemens. The attribution was based on identity signals from CI/CD pipelines such as host IDs and developer domains. The incident is part of a broader supply chain campaign by the threat group TeamPCP (tracked by Google as UNC6780), tracked under the identifier CVE-2026-33634. In the same wave, releases of the security software Trivy were also compromised. The FBI warned in a security advisory that stolen credentials can be misused long after the actual breach.
For CISOs, the incident is relevant because it shows how a single compromised dependency in a widely used AI infrastructure component can systematically harvest secrets across CI/CD pipelines, without requiring explicit code execution by developers. The practical impact has already been confirmed: at Checkmarx, the stolen credentials led to unauthorized access to GitHub repositories. CERT-EU also determined that around 91.7 GB of compressed data was exfiltrated from an AWS account of the European Commission via the attack on the Trivy supply chain.
Security experts and investigative authorities recommend that affected teams check systems for installations of LiteLLM 1.82.7 or 1.82.8 within the time window of March 24, 2026 (10:39 to 16:00 UTC), rotate all credentials, API keys, SSH keys and publishing tokens that were reachable from the affected systems, and search their own GitHub organizations for suspicious repositories with name prefixes such as tpcp-docs or docs-tpcp, which were created by the malware for data exfiltration.
Source: www.it-daily.net · Published August 13, 2026
Lumi AI News — AI-assisted curation pursuant to Art. 50 EU AI Act. Paraphrasing and classification by Lumi News Pipeline v1.8.3.