LiteLLM PyPI Poisoning Harvested CI Secrets for 40 Minutes, Mapping 2,500+ Orgs via TeamPCP Trail

The packages executed on any Python startup, not just LiteLLM imports, allowing transitive pulls from agent frameworks to deliver the payload. CloudSEK’s dataset of 434,000 captured files shows high-confidence matches for NVIDIA, Cisco, Deloitte and others based on CI runner host identities and committer domains; the firm stresses these are not confirmed victim counts but raw loot assessed from confidential sources. Unit 42 and Aqua trace the operation to TeamPCP/UNC6780, which previously force-pushed malicious commits into Trivy after incomplete credential rotation.

FBI FLASH-20260702-01 warns that static tokens harvested in March remain usable months later, inverting standard triage: exposure depends on whether any host process installed the package, not deliberate adoption. The campaign highlights persistent supply-chain exposure when projects accept unpinned dependencies and long-lived secrets in CI runners.

Aqua’s incomplete rotation after the Trivy compromise enabled the March 19 follow-on LiteLLM push, demonstrating how single-point credential hygiene failures cascade across open-source AI tooling. Organizations listed in the CloudSEK lookup should treat domain matches as rotation triggers rather than waiting for exploitation evidence.

Next steps center on migrating CI/CD pipelines to short-lived tokens and enforcing dependency pinning with SBOM attestation; absent those controls, similar 40-minute windows will recur against other AI gateways.