Press play to start listening
On 24 March 2026, as reported by Hackread.com, a major software supply-chain attack compromised the widely used open-source AI proxy LiteLLM. Later investigations by CloudSEK and Hudson Rock indicated that thousands of organisations may have been exposed. Behind the malicious releases was TeamPCP, which uploaded LiteLLM versions 1.82.7 and 1.82.8 to PyPI after gaining access to the project’s publishing process.
According to CloudSEK, the attack did not begin with changes to LiteLLM’s source repository. TeamPCP had previously compromised Trivy’s GitHub Action and release process. LiteLLM’s CI/CD pipeline installed Trivy without pinning it to a verified version, allowing the poisoned scanner to steal the pipeline’s PyPI publishing token.
The attackers then used that token to publish LiteLLM versions 1.82.7 and 1.82.8. According to Snyk’s timestamped account, the releases were available for about three hours before PyPI quarantined the project.
How the Malware Harvested Private Data
According to researchers, Version 1.82.7 contained malicious code in LiteLLM’s proxy server component. Version 1.82.8 added a litellm_init.pth startup hook that executed whenever Python initialized on an affected system, even if LiteLLM was never imported.
The malware, tracked as SANDCLOCK Stealer, stole sensitive information including SSH keys, AWS, Google Cloud and Azure credentials, Kubernetes tokens, CI/CD secrets and AI-provider API keys. Researchers found API keys for services including OpenAI, Anthropic and Google Gemini.
SANDCLOCK then encrypted the collected data before sending it to the attackers. On Linux systems, it also installed a script named sysmon.py and registered it as sysmon.service, allowing the malware to run again after a restart.
Leaked Database
Hudson Rock reported analysing a 153GB archive containing 433,909 files. It attributed 118,829 runner dumps to 2,488 corporate domains. The dataset included evidence associated with major organisations including Samsung Electronics, Amazon Web Services, Cisco Systems, Orange, Boeing, Roku, Deloitte and S&P Global.
However, matching a runner dump to a corporate domain does not by itself prove that the named organisation suffered a successful compromise or that any exposed credential was later used by the attackers.
Explaining the impact of the leak, Alon Gal, co-founder and chief technology officer at Hudson Rock, stated: “The LiteLLM data gives us rare insight into how organizations suffered ransomware attacks lately. By analyzing the compromised CI runner dumps, we can map exactly what the threat actors obtained before launching their extortion campaigns.”
CloudSEK’s reconstructed dataset covers more than 2,500 organisations and approximately 434,000 CI/CD pipelines that may have been exposed. The figures do not establish that every organisation or pipeline executed the malicious package or lost credentials.
Steps for Mitigation
The incident’s risk didn’t end when the malicious packages were removed. A July 2026 FBI FLASH (PDF) warned that stolen credentials associated with TeamPCP could remain useful long after the original compromises.
Organisations that ran the affected releases should rotate accessible credentials, investigate CI/CD activity and check for persistence mechanisms. Snyk identifies LiteLLM 1.82.6 and earlier as unaffected by the malicious releases. Systems that executed versions 1.82.7 or 1.82.8 should be rebuilt from a known-clean source because changing versions will not remove stolen credentials or installed persistence.
The TeamPCP group has been linked to several software supply-chain attacks involving npm and PyPI. It was recently linked to the self-propagating Mini Shai-Hulud worm, which compromised more than 400 package versions and harvested cloud, developer, and cryptocurrency credentials.
Expert Commentary
Rohit Valia, CEO of Tumeryk, said the incident showed why approved open-source software still requires security testing before production. “A single unrevoked token in an open source build chain can result in an ecosystem-wide exposure,” Valia told Hackread.com. “Sanctioned shouldn’t just mean ‘permitted’; it should mean proven.”
