LiteLLM Supply Chain Attack: Are You Affected? What to Do Now

LiteLLM versions 1.82.7 and 1.82.8 were compromised on March 24, 2026 by the TeamPCP threat group. If you installed or upgraded LiteLLM between 10:39 UTC and 16:00 UTC on March 24, treat your environment as compromised and rotate all credentials immediately. This article explains how to detect and remediate.

What Happened: Timeline of the Attack

On March 24, 2026, the threat actor group TeamPCP compromised the PyPI publishing credentials of BerriAI — the company behind LiteLLM, the widely used open-source library that provides a unified interface to 100+ LLM APIs. Using those credentials, they published two malicious versions of the package: 1.82.7 and 1.82.8.

The attack is part of a larger TeamPCP campaign that also compromised PyPI packages for Trivy (a security scanner used in CI/CD pipelines), Checkmarx (a code security tool), and Telnyx (a cloud communications SDK). The common thread: all are infrastructure tools embedded deep in developer workflows, giving the malware maximum opportunity to harvest credentials from build systems, CI/CD environments, and production servers.

What the Malware Did

The malicious LiteLLM versions contained a 3-stage backdoor nearly identical to the payloads used in the Trivy and Checkmarx compromises — suggesting all are from the same threat actor with a consistent toolkit.

The C2 (command-and-control) exfiltration domain used was models[.]litellm.cloud — chosen specifically to blend in with legitimate LiteLLM traffic. A residual reference to checkmarx[.]zone in the persistence code links it to the earlier Checkmarx attack in the same campaign.

While you secure your stack, Happycapy handles research and analysis in a managed, secure environment. No open-source dependency chain to worry about.

Am I Affected? Detection Checklist

Run through this checklist now if your organization uses LiteLLM in any capacity — production, staging, CI/CD, local development, or Docker images.

If You Are Affected: Remediation Steps

If you find evidence of compromise, act in this order:

1. Isolate the affected system — take it offline or block outbound traffic immediately. Do not continue running workloads on a confirmed compromised host.
2. Rotate all credentials — assume every secret the affected machine had access to is compromised: AWS/GCP/Azure API keys, OpenAI/Anthropic/Gemini API keys, database passwords, GitHub tokens, Kubernetes service accounts, .env variables.
3. Upgrade LiteLLM — install the latest version published after March 31, 2026 (post-Mandiant audit). Any version after 1.82.8 from BerriAI is safe.
   pip install --upgrade litellm
4. Remove the persistence artifact — delete any litellm_init.pth files found in site-packages directories.
5. Audit your access logs — review outbound network connections to models.litellm.cloud and checkmarx.zone dating back to March 24. Any connection to these domains indicates active data exfiltration occurred.
6. File an incident report — if you handle personal data (GDPR, CCPA, HIPAA jurisdictions), a supply chain breach of this nature may trigger mandatory breach notification requirements.

The Mercor Breach: What Was Stolen

Mercor, the AI-powered recruiting startup valued at $10 billion, is the first company to publicly confirm it was victimized by the LiteLLM supply chain attack. In a statement to TechCrunch on March 31 / April 1, the company said it was "one of thousands of companies" affected and has engaged third-party forensic experts.

Extortion group Lapsus$ separately claimed responsibility for the breach and posted on its leak site, alleging theft of approximately 4TB of data:

Why This Attack Pattern Is So Dangerous for AI Companies

LiteLLM occupies a uniquely dangerous position in the AI stack. It is not a peripheral library — it is a core infrastructure layer that sits between your application and every LLM API key you use. A compromised LiteLLM installation has direct access to:

• OpenAI, Anthropic, Google Gemini, Mistral, and other LLM API keys
• Database credentials (LiteLLM often proxies requests that touch backend data)
• Cloud provider credentials (AWS, GCP, Azure) in the same environment
• Customer data passing through AI pipelines

With 97 million monthly downloads and deep integration into AI startup tech stacks, LiteLLM was an extremely high-value target. The TeamPCP group targeted it for the same reason they targeted Trivy and Checkmarx: tools that developers install without scrutiny, that run with broad system access, and that touch secrets by design.

The broader lesson: the AI development ecosystem has accumulated significant supply chain risk. The speed at which AI companies adopt new libraries — often without internal security review — creates a large attack surface. Pinning dependency versions, using hash verification, and auditing new installs before production deployment are no longer optional practices for AI companies.

Happycapy is a fully managed AI platform — no package installs, no dependency chain, no supply chain risk. Just powerful AI for writing, research, and analysis at $17/month.

Frequently Asked Questions

• Jagmeet Singh, TechCrunch — "Mercor says it was hit by cyberattack tied to compromise of open-source LiteLLM project" (March 31, 2026)
• Datadog Security Labs — "LiteLLM and Telnyx compromised on PyPI: Tracing the TeamPCP supply chain campaign" (March 24, 2026)
• ReversingLabs — "Inside the TeamPCP cascading supply chain attack" (March 30, 2026)
• LiteLLM official security update — docs.litellm.ai/blog/security-update-march-2026
• Help Net Security — "LiteLLM PyPI packages compromised in expanding TeamPCP supply chain attacks" (March 25, 2026)
• Kaspersky — "Trojanization of Trivy, Checkmarx, and LiteLLM solutions" (March 26, 2026)
• Happycapy AI — managed AI workspace for knowledge workers