Malicious LiteLLM Releases Tied to Trivy Hack May Have Exposed 2,100+ Organizations
Malicious LiteLLM 1.82.7/1.82.8 PyPI releases tied to the Trivy TeamPCP campaign harvested cloud, SSH, and database credentials, potentially exposing 2,500+ organizations.
CloudSEK reported that two malicious LiteLLM releases on PyPI (versions 1.82.7 and 1.82.8, live about 40 minutes on March 24) harvested cloud keys, SSH keys, Kubernetes tokens, and database passwords, with captured loot files mapping potential exposure to more than 2,500 organizations including NVIDIA, Cisco, Deloitte, Volkswagen, FedEx, Siemens, and X Corp. The campaign is part of TeamPCP (tracked by Google as UNC6780), linked to the Aqua Security Trivy scanner compromise tracked as CVE-2026-33634 and added to CISA's Known Exploited Vulnerabilities catalog on March 26. The payload used a litellm_init.pth file executed at Python interpreter startup and exfiltrated secrets to models.litellm[.]cloud; the FBI's FLASH-20260702-01 advisory urged rotation of CI/CD, publishing, and cloud credentials.
- Versions 1.82.7 and 1.82.8 were live on PyPI only ~40 minutes on March 24.
- litellm_init.pth executed at Python startup, harvesting secrets even when LiteLLM was never imported.
- Stolen data sent to attacker-controlled domain models.litellm[.]cloud.
- CVE-2026-33634 added to CISA KEV on March 26; record now lists LiteLLM 1.82.7-1.82.8.
- FBI FLASH advisory urged rotating long-lived CI/CD, publishing, and cloud credentials.
- CVEs
- CVE-2026-33634
- ATT&CK
- T1195.002 Compromise Software Supply ChainT1552.001 Credentials In FilesT1041 Exfiltration Over C2 Channel
- Vendors
- Aqua SecurityCloudSEK
- Countries
- United States
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-33634 | Embedded Malicious Code in Aquasecurity Trivy, trivy-action, and setup-trivy Releases | 9.4 | 60% | KEVPoC ×2 | KEV |
From the original article
5 min read at thehackernews.com
Two malicious LiteLLM releases sat on PyPI for about 40 minutes in March carrying credential-stealing code capable of harvesting cloud keys, SSH keys, Kubernetes tokens, database passwords, and other secrets from systems that installed them.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.