OX Security researchers disclosed a supply chain attack on LiteLLM Python library versions 1.82.7 and 1.82.8 on March 24, 2026 following compromise of a maintainer’s PyPI account by threat actor TeamPCP. LiteLLM is an open-source Python library providing unified interfaces to call over 100 large language models including OpenAI, Anthropic, and VertexAI using standardized input/output formats. The malicious versions contained an infostealer targeting AWS, GCP, GitHub, SSH keys, and cryptocurrency wallets including Bitcoin, Litecoin, Ethereum, and Solana. With over 3 million daily downloads, the compromise potentially affected a large number of users during the approximately 24-hour period before malicious versions were removed. The attack deployed three layers of base64-encoded payloads through a malicious .pth Python configuration file, with the final stage exfiltrating stolen credentials to command and control server models.litellm.cloud after encrypting data with hardcoded OpenSSL keys.

Impact: This supply chain compromise exposed developers and organizations to widespread credential theft through a trusted dependency. Affected systems may have had cloud access keys, infrastructure secrets, communication platform tokens, and cryptocurrency wallet data exfiltrated. Because the malicious logic executed during normal package use, organizations may not have immediate visibility into compromise, increasing the risk of unauthorized access, lateral movement, and financial loss. The malware searches and extracts SSH keys from ~/.ssh/ directories including id_rsa, id_ed25519, id_ecdsa, id_dsa, authorized_keys, known_hosts, and config files. Kubernetes credentials are harvested from /etc/kubernetes/admin.conf, controller-manager.conf, scheduler.conf, and service account tokens at /var/run/secrets/kubernetes.io/serviceaccount/ paths. Google Cloud credentials are stolen from ~/.config/gcloud/ and /root/.config/gcloud/application_default_credentials.json, while Azure credentials are extracted from /.azure directories. The infostealer reads user command history, npmrc, mongorc configurations, and database credentials for LDAP, Redis, MySQL, PostgreSQL, and Postfix installations.

Recommendation: Identify and remove LiteLLM versions 1.82.7 and 1.82.8 from all environments. Rotate all potentially exposed credentials, including cloud provider keys, SSH keys, API tokens, database credentials, and communication platform tokens. Pin dependencies to specific safe versions using exact version numbers rather than unpinned or caret-range specifications that automatically install newer releases. Review installation configurations for unpinned LiteLLM dependencies specified as “litellm” or range-based pins like “litellm^=1.82.6” that would have pulled malicious versions. Audit systems for indicators of compromise, including connections to models[.]litellm[.]cloud and checkmarx[.]zone. Review dependency management practices and pin packages to known safe versions to prevent automatic installation of malicious updates. Inspect systems for unauthorized access to sensitive files such as SSH key directories, Kubernetes configurations, and cloud credential stores. Monitor for suspicious outbound traffic and unusual access patterns involving developer tools and infrastructure resources. Implement least privilege access controls and limit credential exposure within development environments.

Microsoft Defender Security Research reported that on March 19, 2026, Aqua Security’s open-source vulnerability scanner Trivy was compromised in a CI/CD-focused supply chain attack. According to Microsoft, attackers used access from a prior incident that was not fully remediated to tamper with trusted Trivy distribution channels. The activity affected the Trivy core binary, the trivy-action GitHub Action, and the setup-trivy GitHub Action. Microsoft further notes the campaign has since expanded to additional frameworks, including Checkmarx KICS and LiteLLM, though details on that broader activity remain ongoing. The attack abused mutable GitHub tags and compromised credentials with tag write access to force-push malicious commits behind trusted version references in trivy-action and setup-trivy. In parallel, attackers triggered release automation to publish a malicious Trivy binary, v0.69.4, to official distribution channels. On compromised self-hosted GitHub Actions runners, Microsoft observed malware performing process discovery, decoding a Python-based credential stealer, harvesting cloud, Kubernetes, CI/CD, infrastructure, database, and application secrets, encrypting the stolen data, and exfiltrating it to the typosquatted domain scan.aquasecurtiy[.]org. The malware then launched the legitimate Trivy scan so the workflow appeared to complete normally. Microsoft attributes the activity to TeamPCP and states maintainers removed the malicious artifacts later on March 19, ending the active propagation phase.

Impact: This compromise turned trusted security tooling into an access and credential theft mechanism inside build pipelines and developer environments. Organizations using affected Trivy components risk exposure of cloud credentials, Kubernetes secrets, CI/CD secrets, infrastructure access data, and other sensitive material present on runners or developer systems. Because the malicious tooling preserved expected scan behavior, impacted environments may not have obvious operational signs of compromise even where secret theft occurred.

Recommendation: Verify Trivy-related components and update to safe versions identified by Microsoft: Trivy binary v0.69.2 through v0.69.3, trivy-action v0.35.0, and setup-trivy v0.2.6. Review workflows for any use of tag-based GitHub Action references and replace them with verified commit SHAs. Audit CI/CD pipelines for overprivileged GITHUB_TOKEN usage and reduce token and credential permissions to the minimum required. Investigate self-hosted GitHub Actions runners for signs of process discovery, environment variable dumping, metadata service access, Kubernetes secret enumeration, curl-based exfiltration, and references to scan.aquasecurtiy[.]org, 45.148.10.212, /tmp/runner_collected_, or tpcp.tar.gz. Rotate secrets that may have been exposed in affected pipelines, including cloud credentials, Kubernetes service account material, CI/CD tokens, webhook URLs, SSH-related secrets, and database connection strings. Avoid unnecessary exposure of secrets through environment variables and retrieve secrets just in time from dedicated secret managers. Use ephemeral or clean runners and ensure credentials are not persisted across jobs. Restrict third-party action usage through policy controls and allow only approved actions by default. Use available detection content and advanced hunting queries to identify affected hosts, malicious commands, suspicious network activity, and compromised Trivy installations.