01What happened

LiteLLM, a widely deployed open-source LLM proxy gateway (at roughly 3.4 million downloads a day) shipped two malicious releases to PyPI on 24 March 2026. They were live for only about 40 minutes before removal, but the window was long enough for hundreds of thousands of automated installs.

LiteLLM itself was not attacked head-on. The compromise is assessed to have started with the hijack of Trivy, a trusted security scanner. Malicious code was force-pushed over its release tags using a leaked automation token that had been rotated but not fully revoked. That poisoned scanner then flowed into LiteLLM's unpinned build pipeline — producing the tainted 1.82.7 and 1.82.8 packages.

Release 1.82.8 shipped a .pth file that executes at Python interpreter startup, so the payload ran wherever the package was merely installed — even where no code imported LiteLLM and even where teams relied on --ignore-scripts. Because LiteLLM is a transitive dependency of frameworks such as DSPy, MLflow, CrewAI, OpenHands and Arize Phoenix, many affected parties never chose to install it. On each host the credential stealer (tracked by Google as SANDCLOCK) escalated to root and swept SSH keys, AWS/GCP/Azure credentials, Kubernetes tokens, .env secrets, and AI-provider keys including OPENAI_API_KEY and ANTHROPIC_API_KEY. Collected data was sealed and shipped to a typosquatted exfiltration domain (models.litellm[.]cloud, not affiliated with LiteLLM/BerriAI); where exfiltration failed, the malware staged the loot in a public repository created inside the victim's own GitHub account.

Later analysis expanded the timeline: the 40-minute PyPI window is assessed as the closing act of a roughly five-day collection run that began with the Trivy compromise on 19 March — approximately 95% of affected organisations show collection activity before the LiteLLM packages went live. The harvested data is already being brokered on Telegram and linked to the Vect ransomware affiliate programme. Additionally, FBI's July 2026 FLASH advisory assesses the stolen credentials are likely to be weaponised long after the intrusion.

Attribution: the broader campaign is attributed to TeamPCP (tracked by Google Threat Intelligence Group as UNC6780; aliases PCPcat, ShellForce, DeadCatx3), a financially motivated actor whose signature is backdooring trusted developer and security tooling. LiteLLM is one confirmed stage in a sustained 2026 campaign that also touched Trivy, Checkmarx KICS, TanStack, the Telnyx SDK and others — see the related Protos Labs report, TeamPCP's Shai-Hulud Campaign & the Copycat Wave (Jun 2026).

02Incident chronology

• 19 Feb 2026

  An automated agent exploits a pull_request_target misconfiguration in Trivy's GitHub Actions and takes a privileged token. Aqua Security rotates credentials, but containment is not atomic — residual access survives.

• 19 Mar · 17:43 UTC

  TeamPCP force-pushes malicious Trivy release tags and publishes a poisoned build minutes later. Collection activity is first observed ~18 minutes after.

• 22–23 Mar

  Malicious Trivy images pushed to Docker Hub, widening the collection window.

• 24 Mar · 10:39 UTC

  LiteLLM 1.82.7 reaches PyPI. Thirteen minutes later, 1.82.8 adds the interpreter-startup .pth payload.

• 24 Mar · ~11:19 UTC

  PyPI quarantines both releases — roughly 40 minutes after the first went live.

• 26 Mar

  CVE-2026-33634 added to CISA's Known Exploited Vulnerabilities catalogue.

• 2 Jul

  FBI issues FLASH-20260702-01, warning that harvested credentials will be reused.

• 11–13 Aug

  Exposure datasets published: an assessed 2,500+ organisations and ~434,000 CI/CD files reconstructed.

03Who is impacted in Singapore

The following Singapore-linked entities are assessed to appear in the reconstructed exposure dataset.

04Implications for Singapore

• Blast radius is credential-wideRotating only the AI or LiteLLM key is insufficient. Anything a compromised CI runner could read — cloud keys, source-control and publishing tokens, Kubernetes secrets, database URLs, payment and messaging keys — should be assessed as exposed until validated.
• Regulatory obligations may be triggeredUnder the PDPA, MAS Technology Risk Management guidelines and Cybersecurity Act obligations for critical information infrastructure, affected regulated entities may face notification, investigation and remediation duties once exposure is validated.
• Second-generation supply-chain riskIf any npm, PyPI or container-publishing token sat on an affected runner, that organisation's own downstream artifacts should be treated as suspect — one exposed party can silently become the next vector for its customers.
• The threat remains liveHarvested credentials are already advertised for sale and tied to the Vect ransomware operation, which announced a partnership with TeamPCP on BreachForums in April 2026.

05Recommended response

06Sources

Primary vendor research CloudSEK — 2,500+ Companies and 434,000 CI/CD Pipelines Exposed (11 Aug 2026)
SOCRadar — LiteLLM Supply Chain Attack Explained (13 Aug 2026)
Hudson Rock — Largest AI Supply Chain Breach of 2026: LiteLLM Hack Corroborating / primary statements LiteLLM (BerriAI) incident report · Unit 42 · Aqua Security · Google Threat Intelligence Group / Mandiant · Sophos · CERT-EU Government & standards FBI FLASH-20260702-01 · CISA KEV (CVE-2026-33634) · NIST NVD · MITRE ATT&CK