Compromised LiteLLM PyPI packages harvest credentials via supply-chain attack
LiteLLM (BerriAI) · Mar 24, 2026 · Coding agent
What happened
Malicious versions of the litellm Python package (1.82.7 and 1.82.8) were published to PyPI using compromised maintainer credentials, part of the TeamPCP campaign. The payload harvested SSH keys, AWS/GCP/Azure credentials, Kubernetes tokens and database passwords, then exfiltrated them to an attacker-controlled domain. The packages were live for roughly 40 minutes before PyPI quarantined them.
Causal vector
Supply-chain compromise of an LLM gateway package — malicious code executed on install and harvested developer/CI credentials
Source
Reported by LiteLLM (security update). Verified against the primary report.
This is the supply-chain face of the same problem: agent tooling expands the credential blast radius. A spend firewall's value is the policy boundary — limiting what any single agent or tool can touch and spend, so a compromised dependency cannot silently monetize your infrastructure.
The six rule types that contain this class of failure
Per-transaction cap
Any single spend above your ceiling is BLOCKED before it moves.
Daily total
Cumulative spend across all agent calls, bounded per day.
Velocity limit
Stops runaway retry loops — the #1 cause of overnight losses.
Merchant allowlist
Only approved destinations can ever receive funds.
Category rules
Flag high-risk classes (crypto, infra, refunds) for review.
Approval threshold
Above a value, the action waits for a human.
Related incidents
15 malicious JetBrains plugins silently exfiltrated developers' OpenAI, DeepSeek and SiliconFlow API keys
JetBrains Marketplace (third-party plugin authors) · Jun 10, 2026
Step Finance treasury drained in $27–40M exploit
Step Finance · Jan 31, 2026
TRM Labs: $2.87 billion stolen across ~150 crypto hacks in 2025
TRM Labs · Jan 1, 2026
Don't be the next entry
Every incident in this database is the result of trusting a prompt, a provider cap, or a human review cycle. sipi.bot replaces all three with one deterministic call. 67 documented failures, one control.