Executive Summary
Two malicious LiteLLM releases on PyPI for about 40 minutes in March, tied to the Trivy hack, stole cloud keys, SSH keys and tokens; CloudSEK maps exposure to 2,100+ organizations.
What Happened
Two malicious LiteLLM releases sat on PyPI for about 40 minutes in March carrying credential-stealing code capable of harvesting cloud keys, SSH keys, Kubernetes tokens, database passwords, and other secrets from systems that installed them. Threat intelligence firm CloudSEK now says a dataset it obtained, built from roughly 434,000 files the attackers captured, maps potential exposure to more
Affected Products
- LiteLLM
- PyPI
- Trivy
Vulnerability / Attack Technique
Poisoned AI gateway releases
Technical Mechanism
Credential-stealing code ran on install.
AI Security Category
LLM03:2025 Supply Chain
Part of the AI Supply Chain and AI SBOM topic.
Relevant Frameworks
RealGround Analysis
A 40-minute window was enough for wide exposure. RealGround analysis: lockfiles and delayed adoption of new releases reduce this risk.
Recommended Controls
- Pin dependencies with hashes
- Rotate secrets from affected systems
Related RealGround Service
AI Agent SBOM and LLM Mapping · or start with the free AI Agent Security Scanner.
Sources
thehackernews.com: https://thehackernews.com/2026/08/malicious-litellm-releases-tied-to.html
Summary and analysis written by RealGround from the source above; last updated 2026-10-18.