Chain Cyberattack: How a Virus Tricked Thousands of Developers

Published on March 29, 2026 at 11:57

A massive cyberattack has just hit the world of artificial intelligence. Hackers have indeed managed to compromise a software brick used by many developers. The hack triggered a chain reaction resulting in an enormous data theft.

LiteLLM, one of the most widely used Python libraries in the generative AI ecosystem, has just been attacked. The library, which has over 40,000 stars on GitHub, provides a unified interface that allows interaction with large language models, such as those from OpenAI, Google, or Anthropic. For developers, using LiteLLM allows connecting to a wide variety of AI models. That is why the library, developed by BerriAI in 2023, quickly became popular among developers.

That is also why it ended up in the crosshairs of cybercriminals. In early March 2026, TeamPCP, a gang of cybercriminals specialized in supply chain attacks, managed to compromise the LiteLLM library. To achieve their goals, the hackers launched an attack against a tool that had nothing to do with the library. We explain the sequence of the cyberattack.

Software horror: litellm PyPI supply chain attack.

Simple `pip install litellm` was enough to exfiltrate SSH keys, AWS/GCP/Azure creds, Kubernetes configs, git credentials, env vars (all your API keys), shell history, crypto wallets, SSL private keys, CI/CD secrets, database… https://t.co/aKjZJcECFq

— Andrej Karpathy (@karpathy) March 24, 2026

Also read: "I had to run all the way to my Mac mini" – a Meta expert lost control of her AI

A supply chain cyberattack

First, TeamPCP targeted the vulnerability scanner Trivy by Aqua Security. This free tool, which allows checking the security of code lines, is widely used by developers… including by the LiteLLM team to test their updates. The hackers managed to compromise the GitHub account of Trivy. They then published a fake official version of Trivy. This infected version contained a virus capable of stealing data.

Once installed, the fake version of the tool discreetly stole passwords from users, including those of the LiteLLM team. With these stolen passwords, the hackers were able to access the team's computers as well as the servers handling updates. On March 24, 2026, the cybercriminals slipped malware into two library updates. Unaware, LiteLLM deployed two malicious updates on PyPI, the official and centralized repository for Python software packages.

Users of LiteLLM therefore installed malware on their devices. Once on the machine, the virus will search for all data it can suck up. It will particularly take passwords and tokens, configuration files, tokens, histories, AWS keys, Google Cloud, Azure keys, or even files related to crypto wallets. The stolen data is encrypted, compressed, and transferred to a domain controlled by the hackers.

The virus won't stop there. To ensure it remains installed permanently on infected machines, TeamPCP's malware will implant a backdoor. This backdoor starts automatically every time the machine boots, restarts itself even if the user closes the process, and runs in the background without any visible window or message. Then, the virus won't stay quietly on a single machine. The malware will spread to other machines and servers within the company.

Also read: This popular AI application exposed the conversations of 25 million users online

An attack discovered by accident

Shortly after the infection, the cyberattack was accidentally discovered by a developer at FutureSearch company. He was typing code in Cursor, an editor that relies largely on AI. Behind the scenes, the editor automatically installs small software blocks, including LiteLLM. As soon as the library is installed, the developer realizes something is wrong. His computer starts violently crashing and becomes quickly unusable.

By investigating the ongoing processes on the machine, he discovers that an unusual element is present in the recent version of LiteLLM 1.82.8. The developer then raised the alarm. FutureSearch researchers start investigating and gradually discover how a data-stealing virus managed to slip into the library.

Once the alert was given, the infected versions 1.82.7 and 1.82.8 were removed and quarantined on PyPI. The LiteLLM team quickly communicated, asking users to revert to the previous version, namely 1.82.6, while they fix the issue and secure their systems. FutureSearch researchers estimate that all data that came into contact with a machine that installed malicious LiteLLM versions are compromised.

"If you have installed or run litellm v1.82.7 or v1.82.8, treat all credentials present on the affected systems as compromised", LiteLLM echoes the same sentiment.

A particularly fragile supply chain

The attack on LiteLLM highlights the dangers inherent in the supply chain. In this case, it was enough to hack a single account to contaminate a huge part of the ecosystem. This chain reaction even affected developers who never chose LiteLLM themselves. Many AI tools, such as agents or plugins, indeed rely on LiteLLM, a tool managed by a small team of developers. Adopted by Netflix, Stripe, or Google, the tool is used by millions of developers. It is even downloaded 3.4 million times a day. That's why we can consider the current software supply chain as particularly fragile.

The open source supply chain is collapsing in on itself.

Trivy gets compromised → LiteLLM gets compromised → credentials from tens of thousands of environments end up in attacker hands → and those credentials lead to the next compromise.

We are stuck in a loop. https://t.co/3GHrnApvWs

— Nagli (@galnagli) March 24, 2026

For Gal Nagli, an open source threat expert at Wiz, « the open-source supply chain is collapsing on its own ». Another Wiz researcher, Ben Read, points out that « tools like LiteLLM are present in more than a third of cloud environments », which contributes to weakening the entire ecosystem. Endor Labs researchers estimate that TeamPCP hackers will return to attack and that « this campaign is almost certainly not over ».