Malicious LiteLLM Releases May Have Exposed Thousands of Organizations
A recent investigation has revealed that two malicious LiteLLM releases were published on PyPI in March, potentially exposing over 2,500 organizations to credential-stealing code.
## Malicious LiteLLM Releases Exposed Thousands of Organizations A recent investigation has revealed that two malicious LiteLLM releases were published on PyPI in March, potentially exposing over 2,500 organizations to credential-stealing code. The releases, versions 1.82.7 and 1.82.8, were live on the platform for approximately 40 minutes before being quarantined. LiteLLM is an open-source AI gateway used to connect applications with multiple model providers. The compromised packages were designed to collect environment variables, SSH keys, cloud credentials, Kubernetes tokens, and database passwords before encrypting and sending stolen data to an attacker-controlled domain. ## Investigation Reveals Wider TeamPCP Supply-Chain Campaign The malicious LiteLLM releases are part of a wider TeamPCP supply-chain campaign linked to Aqua Security's Trivy scanner. The campaign, tracked as UNC6780 by Google, involves the use of compromised Trivy dependencies to upload malicious code to PyPI. The compromised Trivy components include version tags and setup-trivy tags, which were force-pushed by attackers on March 19. ## Organizations Affected by Malicious LiteLLM Releases The investigation has identified several organizations that may have been affected by the malicious LiteLLM releases. These include NVIDIA, Cisco, Deloitte, Volkswagen, FedEx, Siemens, and X Corp. However, it is essential to note that the presence of these organizations in the dataset does not necessarily mean that their credentials were used. ## Steps to Take to Assess Exposure Organizations affected by the malicious LiteLLM releases should take the following steps to assess their exposure: - Check for LiteLLM 1.82.7 or 1.82.8 installations during LiteLLM's March 24 audit window of 10:39 to 16:00 UTC. - Rotate any secrets those systems could access. - Search their GitHub organizations for repositories named tpcp-docs or docs-tpcp, which the FBI lists as campaign indicators. ## Downstream Impact of the Campaign The campaign's downstream impact is confirmed even if the scale figures are not. Checkmarx said credentials obtained through the Trivy attack enabled unauthorized access to its GitHub repositories and the publication of malicious artifacts. Mercor said it was affected by malicious LiteLLM versions and contained unauthorized activity. CERT-EU separately assessed with high confidence that a European Commission AWS account was compromised through the Trivy supply-chain attack, with about 91.7 GB of compressed data exfiltrated. The investigation highlights the importance of rotating secrets and monitoring GitHub repositories for campaign indicators to prevent similar attacks in the future.
