How LiteLLM Turned Developer Machines Into Credential Vaults for Attackers

This article analyzes the March 2026 LiteLLM supply chain attack and provides guidance on protecting developer endpoints from credential harvesting.

• •TeamPCP injected infostealer malware into LiteLLM PyPI packages (versions 1.82.7 and 1.82.8), targeting SSH keys, AWS/Azure/GCP credentials, and Docker configs
• •1,705 PyPI packages had LiteLLM as a transitive dependency, meaning projects like dspy (5M downloads/month) could trigger malware without directly using LiteLLM
• •GitGuardian's analysis of 6,943 compromised machines found 33,185 unique secrets, each appearing in ~8 locations per machine; 59% of systems were CI/CD runners
• •Recommended mitigations include scanning local filesystems with ggshield, moving secrets into centralized vaults, using OIDC federation to replace static cloud keys, and deploying honeytokens in predictable attacker target paths