How a Single Poisoned Python Package Nearly Compromised Every AI API Key on the Internet
The LiteLLM supply chain attack hit a package with 95M monthly downloads, present in 36% of cloud environments, exposing how fragile the AI tooling trust chain really is.
On 24 March 2026, someone published two poisoned versions of LiteLLM to PyPI. No code on GitHub. No release tag. No pull request. No review. Just a quiet upload to the Python Package Index, and every machine that installed it started leaking credentials within seconds.
LiteLLM is not an obscure utility. It is the package that routes API keys for OpenAI, Anthropic, Google and Amazon through a single proxy. The attacker picked the one dependency whose entire job is holding every AI credential in the organisation in one place.
TL;DR
A threat group called TeamPCP poisoned LiteLLM by first compromising the Trivy security scanner, then chaining stolen credentials across five package ecosystems in two weeks. The malware ran on install, harvesting every API key, SSH key and cloud token on the machine. Sloppy code that crashed systems is the only reason thousands of companies are not fully exfiltrated today.
What exactly happened to LiteLLM
Malicious versions 1.82.7 and 1.82.8 sat on PyPI for roughly three hours, from 08:30 to 11:25 UTC on 24 March, before PyPI quarantined them. Three hours sounds survivable until you remember LiteLLM averages about 3.4 million downloads a day. Even a fraction of that window means thousands of compromised installs.
The poisoned package did not wait to be imported. It did not need a function call. The payload fired the moment the package existed on disk, embedded in a file that the Python runtime executes automatically on startup.
Most supply chain attacks target packages people deliberately install. This one targeted a package that sits underneath other tools as a transitive dependency. Developers who had never heard of LiteLLM had it running because an IDE plugin or an AI framework pulled it in silently.
Why LiteLLM was the perfect target
Consider what the library does. It is a universal proxy for AI model APIs, which means it handles credentials for OpenAI, Anthropic, Google Cloud AI, Amazon Bedrock, Azure OpenAI, Cohere and dozens more through one interface. Compromise it once and you do not get one API key. You get all of them, across every provider, team and environment where the package is installed.
How TeamPCP chained five ecosystems in two weeks
The attack did not start with LiteLLM. It started with Trivy, an open source security scanner. On 19 March, TeamPCP compromised Trivy's CI/CD pipeline. The tool companies run to detect supply chain attacks became the entry point for one.
Trivy CI/CD, 19 March
The compromised pipeline exposed credentials stored in the build environment.
GitHub Actions, 20 March
Those credentials unlocked Actions secrets belonging to downstream projects.
Docker Hub, 21 March
Actions secrets contained Docker Hub publishing rights.
npm and Open VSX, 22 March
Docker access led to npm tokens and extension registry publishing rights.
PyPI and LiteLLM, 24 March
Harvested CI credentials finally produced the PyPI publishing token for LiteLLM.
Each breach funded the next. Each ecosystem assumed the ecosystem upstream of it was secure. None of them were. Supply chain incidents already averaged 26 per month through 2025, but this was not a smash and grab on one registry. It showed that modern package ecosystems are interconnected in ways defenders have not mapped and attackers clearly have.
What the three-stage payload actually did
Stage 1: credential harvesting
On install, the payload swept the machine for SSH private keys, AWS and GCP tokens, Kubernetes service account credentials, crypto wallet files, every.env file on disk and browser credential stores, then shipped them to attacker infrastructure.
Stage 2: container deployment
Using harvested Kubernetes credentials, it deployed privileged containers across every node in the cluster, not only the compromised workstation, giving root level access to production.
Stage 3: persistent backdoor
A lightweight backdoor sat dormant waiting for command and control instructions. Removing the malicious package did not remove it. The stage was designed to survive incident response.
The saving grace was incompetence. The implementation was so resource hungry that it crashed machines. A developer noticed a workstation eating absurd amounts of RAM, investigated, and found the compromise. A marginally better payload would have run silently for weeks across thousands of production environments.
The entry point nobody saw: a transitive dependency
The developer who found this never installed LiteLLM. It was never in a requirements file. It arrived through a Cursor MCP plugin they did not know they had.
Roughly 877,000 malicious packages were found in open source repositories last year, up from about 512,000 the year before. That is the haystack. Now add the detail that around 95% of vulnerable component downloads already had a fix available. Teams simply did not know which version they were pulling.
Dependency chains are not a new problem, but AI tooling has made them dramatically worse. One AI coding assistant plugin can pull dozens of packages nobody has audited. You do not choose LiteLLM. It chooses you.
The AI supply chain blind spot is widening
Enterprise AI adoption reached roughly 78% in 2025, and analysts expect 40% of enterprise applications to ship task specific agents during 2026, up from under 5% a year earlier. Every one of those agents sits on a dependency stack nobody audits with the rigour applied to first party code.
The supporting numbers are grim. Around 86% of commercial codebases contain vulnerable open source components, and 81% of those carry high or critical risk issues. Third party involvement in breaches doubled in a single year, from 15% to 30%. Supply chain attacks are projected to cost about 60 billion dollars globally in 2025, rising towards 138 billion by 2031, and the average breach of this type takes 254 days to detect and contain. TeamPCP's sloppy code cut that to three hours by accident.
What CTOs and security teams should do this week
Audit your AI dependency chain
Do not stop at requirements.txt or package.json. Map the full transitive tree for every AI tool, IDE plugin and agent framework in use, and flag anything that handles credentials or tokens. Those are the next targets.
Verify source to registry consistency
The poisoned versions existed on PyPI but not on GitHub. Add checks that flag any published artifact with no matching tagged release in the source repository.
Pin versions and verify checksums
Stop using version ranges for security sensitive dependencies. Pin exact versions, verify checksums, commit lock files. The maintenance overhead is far cheaper than rotating every AI credential you own.
Monitor runtime behaviour
This malware was caught because it crashed machines. Deploy monitoring that flags unexpected outbound connections, reads of.env and.ssh paths, and abnormal resource consumption.
Segment AI tool permissions
Coding assistants and agent frameworks should never hold production credentials, cluster admin tokens or infrastructure SSH keys. Sandbox them and issue scoped, short lived tokens instead of master keys.
Rehearse the rotation
Write the runbook for a full credential rotation across every AI provider before you need it, then test it. Our wider guidance on zero trust and cyber resilience covers the surrounding controls.
Building these gates into delivery is a pipeline problem as much as a security one, which is why we treat it as part of DevOps and CI/CD design rather than a bolt on. The same discipline applies to anything we ship through web development.
The trust model is broken
The attack exposed something the security community has warned about for years. Open source trust chains were not built for a world where AI tools pull in dozens of invisible dependencies, each one an attack surface.
- One compromised maintainer account turned five package ecosystems into a credential harvesting operation
- The malware was caught by accident, not by a security tool
- Transitive dependencies are the real surface, since the person who found it never chose to install the package
- AI tooling amplifies the blast radius, because one proxy library holds keys to every provider
- TeamPCP has publicly committed to targeting more security tools and open source projects
Teams shipping AI agents fastest need to slow down long enough to understand what sits underneath them. Audit the chains. Verify the sources. Segment the credentials. And do not count on the next payload being kind enough to crash your machine as a warning.
Want a second pair of eyes on your AI supply chain?
We run dependency audits, pipeline hardening and credential segmentation reviews for engineering teams.
Queries raised before signature
Everything worth knowing about How a Single Poisoned Python Package Nearly Compromised Every AI API Key on the Internet.
01Was my organisation affected by the LiteLLM attack?
The malicious versions were 1.82.7 and 1.82.8, live for roughly three hours on 24 March 2026. Search your install logs and lock files for those versions. If either appears, assume full credential compromise and begin rotation immediately.
02How did TeamPCP get permission to publish LiteLLM packages?
They compromised Trivy's CI/CD pipeline on 19 March, then chained stolen credentials through GitHub Actions, Docker Hub and npm until they reached the PyPI publishing token. It was a cascade across five ecosystems rather than a single breach.
03Can SCA tools like Snyk or Dependabot stop this kind of attack?
Software composition analysis catches known vulnerabilities. This was a zero day injection into a legitimate package, so no advisory existed. You need source to registry verification and runtime behaviour monitoring alongside conventional scanning.
04Why are AI packages such high value targets?
An AI proxy library holds credentials for several providers at once. One compromise yields keys for OpenAI, Anthropic, Google, Amazon and others, so the blast radius per package is far larger than a typical dependency.
05Is TeamPCP still active?
Yes. After the attack the group stated publicly that more security tools and open source projects would be targeted in the coming months. They have demonstrated capability across five ecosystems and should be treated as a persistent threat.
06How do I tell whether LiteLLM is in my stack at all?
Generate a full dependency tree rather than reading your manifest. Use pip's dependency inspection, a lock file diff or an SBOM, then search for the package name. Plugins for AI editors and agent frameworks are the usual reason it appears.
07Which credentials should be rotated first?
Start with anything that grants publishing or deployment rights: CI tokens, registry tokens, cloud keys and cluster credentials. Then rotate AI provider keys, then user level secrets. Revoke rather than only reissue.
08Does a lock file protect me from this?
A lock file prevents accidental upgrades into a poisoned version, which is valuable. It does not help if you resolve dependencies during the exposure window, so pair pinning with checksum verification and a delay before adopting brand new releases.
09Should we ban AI coding assistants?
Banning them is rarely realistic and usually pushes usage underground. Sandbox them instead: separate machine accounts or containers, no production credentials, scoped tokens with short lifetimes, and an approved list of plugins.
10What is a reasonable detection window to aim for?
The industry average for supply chain compromise is around 254 days. With install time monitoring, egress controls and secret scanning in place, hours rather than months is achievable, which is the only timescale that limits damage.
11How does an SBOM help here?
A software bill of materials records exactly which versions shipped in which build. When an advisory lands you can answer in minutes whether you are exposed, instead of rebuilding history from memory.
12Can e10 Infotech help us audit this?
Yes. We map transitive dependency trees, add source to registry verification into pipelines, segment AI tooling permissions and set up runtime monitoring, then hand over the runbooks so your team can maintain it.
Sign off and we start
Tell us what you are trying to build. You will hear back from an engineer, not a sales desk.
- For
- e10 Infotech Private Limited
- Office
- Mumbai, Maharashtra
- Established
- 2011
- Direct line
- +91 86574 40720