Two malicious releases of LiteLLM, the widely used AI-model proxy library, were published to PyPI in March carrying credential-stealing code that could harvest cloud keys, SSH keys, Kubernetes tokens, database passwords, and other secrets from systems that installed them2. The compromised packages sat on PyPI for approximately 40 minutes before removal.
The attack vector traces back to a compromise of Trivy, through which LiteLLM was itself compromised and then abused to distribute information-stealing malware to its users1.
Threat intelligence firm CloudSEK says it obtained a dataset built from roughly 434,000 files the attackers captured. SecurityWeek reports that over 2,500 organizations were impacted. The Hacker News, citing CloudSEK's analysis, places the figure at more than 2,100 organizations with potential exposure mapped from the captured dataset.
ANALYSIS The discrepancy between the two reported figures — over 2,500 versus more than 2,100 — may reflect different scoping methodologies or different stages of the same investigation, but both point to a broad blast radius from a narrow window of exposure.
A 40-minute window on PyPI was sufficient to compromise hundreds of thousands of files across thousands of organizations, underscoring the speed at which automated dependency resolution can propagate a poisoned package through AI-infrastructure stacks.
The credential types targeted — cloud keys, SSH keys, Kubernetes tokens, and database passwords — span the full surface area of a typical AI serving or training environment. ANALYSIS Exfiltration of these credential classes could grant attackers lateral access to model-serving infrastructure, training clusters, and backing datastores, making the downstream risk profile considerably wider than the initial package installation footprint.