LiteLLM Breach Exposes AI Supply Chain Risk

LiteLLM's March 24 update said the investigation indicated that a maintainer's PyPI account may have been compromised. Snyk reports that stolen credentials from a prior Trivy compromise were used to gain unauthorized access to the LiteLLM publishing pipeline. Datadog and Snyk linked the event to a broader campaign tracked as TeamPCP, which they report had previously compromised elements of the Trivy supply chain.

The LiteLLM GitHub incident record stated that the malicious versions were uploaded directly to PyPI rather than released through the project's official GitHub CI/CD process. That distinction matters operationally: source repository integrity, CI workflow integrity, package registry publishing rights, and delivered artifact integrity are separate controls.

LiteLLM said users of its official Proxy Docker image were not affected because its dependencies were pinned in requirements.txt and did not rely on the compromised PyPI versions. That statement does not establish safety for other installation paths. Datadog recommended treating hosts and CI jobs that installed either affected LiteLLM version as full credential-exposure events, including investigation for persistence, outbound traffic, and Kubernetes activity.

LiteLLM said it deleted the compromised packages, rotated maintainer accounts, and published SHA-256 checksums for audited PyPI and Docker releases. In a March 30 update, the company announced clean v1.83.0, describing a new release pipeline with isolated environments, stronger security gates, and separation between release stages. It also stated that its codebase had been verified and that no malicious code had been pushed to main.

For ML platform teams, the incident is a concrete example of why LLM gateways and SDK dependencies belong in the same software supply-chain threat model as build tools, CI actions, and cloud credentials. Packages in these paths often run inside environments holding provider API keys, deployment credentials, and Kubernetes configuration. Comparable incidents across open-source ecosystems have made artifact pinning, hash verification, provenance checks, least-privilege publisher accounts, and rapid secret rotation central controls rather than optional hardening.