Malicious releases published to PyPI (CVE-2026-33634)
Two releases, 1.82.7 and 1.82.8, were published straight to PyPI carrying a credential stealer. Neither version was ever tagged on GitHub — the attacker bypassed the project's CI/CD entirely and uploaded to PyPI directly, using an API token exposed through the compromised Trivy releases in the wider TeamPCP campaign.
The payload collected environment variables, model API keys, SSH keys, AWS, GCP and Azure credentials, Kubernetes tokens, database passwords, shell history and CI/CD secrets, encrypted them with AES-256 under an RSA-4096 key, and posted them to models.litellm[.]cloud — a domain registered the day before the upload and unconnected to the project. It then polled checkmarx[.]zone for follow-on code and persisted via a systemd user unit named sysmon.service.
1.82.8 is the more dangerous of the two. It shipped a litellm_init.pth file, which Python executes at interpreter startup, so the stealer ran on any Python process on the machine whether or not anything imported LiteLLM. In 1.82.7 the payload sat in proxy_server.py and only ran when litellm.proxy was imported.
Accounts differ How long the packages were installable is disputed by the parties involved. LiteLLM says they were live from 10:39 UTC and quarantined after roughly 40 minutes, while PyPI's own incident report puts LiteLLM's exposure at 2 hours 32 minutes from upload to quarantine, and the GitHub issue tracking it records the upload at around 08:30 UTC. LiteLLM's own advice is the safest reading: treat any install between 10:39 and 16:00 UTC on 24 March 2026 as suspect.
Package-level download counts were never published. CloudSEK put the campaign's captured dataset at roughly 434,000 files, mapping potential exposure to more than 2,500 organisations — that is the whole TeamPCP campaign, not LiteLLM alone, and the file count is not a deduplicated count of victims.
PyPI quarantined the project and both versions were removed; they no longer resolve. 1.82.6 and 1.83.0 are unaffected and remain available.
If you installed LiteLLM from PyPI inside the 24 March window, treat every credential reachable from that host as compromised and rotate it — model keys, cloud credentials, SSH keys and CI tokens. Check for litellm_init.pth in site-packages, a sysmon.service user unit, and outbound traffic to models.litellm[.]cloud or checkmarx[.]zone.
This was a compromise of the distribution channel, not a flaw in the gateway's own code, and the maintainers did not write the malware. It is recorded here because the failure mode it exposes is structural: a self-hosted gateway installed from a public package index inherits that index's supply-chain risk, and this gateway is one that sits directly on your model keys and cloud credentials. Pin versions and verify hashes rather than tracking latest.