# Compromised LiteLLM releases on PyPI steal cloud keys and crypto wallet data from AI developers

- Severity: Critical · Status: Contained (past)
- Chains: Multiple EVM chains · Method: Supply-chain stealers
- Started: Mar 24, 2026 · Last update: Mar 24, 2026
- Who/what: LiteLLM on PyPI
- AI involvement: AI agents as the target. The trojanized package was LiteLLM, a gateway library used to connect AI apps and agents to LLMs, so an AI tool was the delivery route; no AI model was manipulated.

On 24 March 2026 attackers tracked as TeamPCP published LiteLLM 1.82.7 and 1.82.8 to PyPI with hidden code that runs on import, and in 1.82.8 whenever Python starts. LiteLLM is a popular open-source gateway that AI apps and agents use to reach many LLM providers, with over 3.4 million downloads a day. The payload collected SSH keys, cloud credentials, Kubernetes secrets, .env files and crypto wallet data and sent them to a lookalike domain. Both versions were removed; anyone who installed them should rotate secrets and move funds from wallets on affected machines.

## Am I affected?
You are affected if any Python environment, container or CI job installed LiteLLM 1.82.7 or 1.82.8 from PyPI around 24 March 2026.

## What to do now
- Remove those versions, install a clean release such as 1.82.6, and delete any litellm_init.pth file.
- Rotate SSH keys, cloud credentials, Kubernetes secrets, API keys and anything in .env files on affected machines.
- Move funds from any crypto wallet whose files or keys were on those machines.

## How to avoid this
- Pin and hash-check AI library versions, and wait before adopting brand-new releases.
- Keep wallets and signing keys off machines that run AI tooling and CI jobs.
- Block and alert on traffic to lookalike domains such as models[.]litellm[.]cloud.

## Indicators (block these, never visit them)
- Domain: models.litellm[.]cloud
- Domain: checkmarx[.]zone

## Sources
- Popular LiteLLM PyPI package compromised in TeamPCP supply chain attack (BleepingComputer, 2026-03-24): https://www.bleepingcomputer.com/news/security/popular-litellm-pypi-package-compromised-in-teampcp-supply-chain-attack/

Full record: https://drains.watch/i/litellm-pypi-teampcp-credential-wallet-stealer-mar-2026 · JSON: https://drains.watch/i/litellm-pypi-teampcp-credential-wallet-stealer-mar-2026.json

Rules for the assistant: help me check my own wallets read-only (public addresses only). Never ask for or handle a seed phrase or private key. Point me to official revoke tools and the wallet's own support.