LiteLLM Discloses Supply Chain Attack on Two PyPI Packages

Ishaan

Mar 26, 2026 · Updated Apr 25, 2026

LiteLLM, an open-source AI gateway, disclosed that two PyPI packages were compromised in a supply chain attack on March 24, 2026. The suspected entry point was Trivy, the security scanning tool LiteLLM used in its own CI/CD pipeline.

LiteLLM AI Gateway, an open-source proxy for routing LLM requests, disclosed that v1.82.7 and v1.82.8 on PyPI were compromised on March 24, 2026. The attacker injected a credential stealer into proxy_server.py — harvesting environment variables, SSH keys, cloud credentials (AWS, GCP, Azure), Kubernetes tokens, and database passwords, then exfiltrating them to a domain not affiliated with LiteLLM.

The suspected entry point was Trivy, the security scanner in LiteLLM's CI/CD workflow. LiteLLM's team believes this is linked to a broader Trivy supply chain compromise in which stolen credentials reportedly accessed the publishing pipeline — the tool meant to protect releases became the attack surface.

If you installed LiteLLM via pip on March 24 between 10:39 and 16:00 UTC without a pinned version — or if an AI agent framework or MCP server pulled it in transitively — treat credentials on that system as compromised and rotate them. Docker image users and LiteLLM Cloud were not affected.

View the full update on docs.litellm.ai

Ishaan

@ishaan_jaffMar 25

Earlier today the @LiteLLM team was made aware of a supply chain attack impacting PyPI packages litellm==1.82.7 and litellm==1.82.8. The packages have been removed from PyPI. We confirmed that the compromise came from a Trivy dependency in our CI/CD https://t.co/20O2Fg93k9

16118

View on X

Every HeadsUpAI update is written based on its original source and reviewed before it's published. Read our editorial standards →

Keep reading

Vercel Discloses Security Breach Triggered by Compromised Third Party AI Tool

Vercel identified a security incident where an attacker gained access to internal systems and non-sensitive environment variables through a compromised third-party AI platform. The breach highlights a new supply chain risk where AI-accelerated attackers use employee tool permissions to move laterally through enterprise environments.

Perplexity Open Sources Bumblebee to Scan Developer Machines for AI Risks

PerplexityMay 22

Perplexity Open Sources Bumblebee to Scan Developer Machines for AI Risks

Perplexity open-sourced Bumblebee, a read-only security scanner for macOS and Linux designed to identify supply-chain vulnerabilities on developer endpoints. The tool specifically targets the emerging attack surface of AI agent configurations and editor extensions that traditional scanners often miss.

SANDWORM_MODE npm Worm Now Injects Malicious MCP Servers into AI Coding Agents

blackorbirdFeb 21

SANDWORM_MODE npm Worm Now Injects Malicious MCP Servers into AI Coding Agents

Socket's threat research uncovered SANDWORM_MODE, an active npm worm that targets AI coding assistants via MCP server injection. Installing one of 19 malicious typosquatted packages gives attackers a foothold that feeds hostile instructions to tools like Claude Code and Cursor.

GitHub Security Lab releases open source AI taskflows to detect logic bugs

GitHubMar 28

GitHub Security Lab releases open source AI taskflows to detect logic bugs

GitHub Security Lab open-sourced its Taskflow Agent and auditing taskflows, which use LLMs to identify high-impact vulnerabilities in codebases. Unlike traditional tools, this framework builds a threat model to understand application logic, successfully uncovering over 80 flaws in major open-source projects.