LiteLLM Compromised: How the AI Gateway Became the Attack Surface

On March 24, 2026, attackers published LiteLLM versions 1.82.7 and 1.82.8 to PyPI. The packages were live for approximately three hours. LiteLLM processes 3.4 million downloads per day and is present in 36% of cloud environments. In those three hours, any environment that pulled a fresh install or dependency update acquired a three-stage payload: credential harvesting, lateral movement into Kubernetes clusters, and a persistent systemd backdoor.

The attack was not a zero-day. It was a supply chain compromise enabled by a single unpinned dependency.

How TeamPCP Got In

The JFrog Security Research team has published a detailed breakdown tracing the attack to threat actor group TeamPCP — the same group responsible for prior compromises of Aqua Security’s Trivy scanner and Checkmarx’s KICS GitHub Action.

The sequence: on March 19, TeamPCP compromised Trivy’s GitHub Action. LiteLLM’s CI/CD pipeline ran Trivy without a pinned version — meaning it fetched the latest, now-compromised action on its next build. The compromised action exfiltrated LiteLLM’s PyPI publish token from the GitHub Actions runner. TeamPCP used that token five days later to publish the malicious versions.

The payload in version 1.82.8 was engineered to evade detection. It exploited Python’s .pth file mechanism — which fires on every Python interpreter startup, regardless of whether LiteLLM is explicitly imported — with a double base64-encoded payload to defeat static analysis. The exfiltration domain, models.litellm.cloud, was registered the same day, impersonating legitimate LiteLLM infrastructure.

Discovery came unintentionally: a researcher pulled LiteLLM as a transitive dependency through an MCP plugin running inside Cursor. Their machine became unresponsive from RAM exhaustion — a fork-bomb bug in the malware. Without that incidental signal, the compromise might have propagated much further.

The Pattern

Three posts in the last two weeks trace the same arc: the AI development toolchain has become the primary attack surface. BetterLeaks covered how secrets accumulate in AI-generated code without detection. JFrog Curation addressed the dependency gatekeeping gap. This LiteLLM compromise is the attack that confirms the threat both tools were designed to address.

The Broader Attack Progression

The LiteLLM compromise is the third named incident in a pattern JFrog has tracked since at least September 2025:

• Shai-Hulud (September 2025): A self-replicating npm worm that stole developer tokens and auto-reinfected packages those developers maintained — described by JFrog as “one of the most severe JavaScript supply chain attacks on record.”
• postmark-mcp (September 2025): A threat actor cloned the legitimate Postmark MCP repository and ran 15 clean versions before silently adding a BCC that forwarded all emails — password resets, invoices, internal memos — to an attacker-controlled domain. The first malicious MCP server found in the wild.
• LiteLLM (March 2026): Same playbook applied to an AI gateway with 3.4 million daily downloads.

The attacker logic is consistent: identify a high-value, widely adopted AI infrastructure component; compromise it via an upstream dependency rather than the target directly; and use reach to maximize credential and access exposure before detection.

Source: JFrog

Content created with AI assistance and reviewed for accuracy.