We didn't see the next supply chain attack coming from the AI proxy layer. But we should have.
On March 27, 2025, a pair of malicious packages—litellm versions 1.82.7 and 1.82.8—landed on PyPI. They stayed live for just 40 minutes. In that window, they harvested 78,330 credentials from 2,186 organizations. SSH keys, AWS/GCP/Azure tokens, Kubernetes secrets, LLM API keys—all siphoned through a .pth file that required zero developer action to execute. The attack was not a theoretical drill. It was a real, automated, and surgical poisoning of the most trusted layer in the AI agent stack: the package registry.
This is not a story about a single vulnerability. It's a story about how the entire AI infrastructure trust model is now under systematic assault. And the defenders are still playing catch-up.
Context: Why LiteLLM Was the Perfect Target
LiteLLM is not a side project. It's the de facto standard for managing API keys across multiple LLM providers—OpenAI, Anthropic, Google, Mistral, and dozens more. It's the middleware that sits between your application and the model endpoints. If you're running an AI agent in production, there's a high chance LiteLLM is somewhere in the call chain.
Its value proposition is simple: one unified interface, one set of keys, one logging layer. But that centralization is exactly what makes it a high-value target. Compromise LiteLLM, and you compromise the entire credential set of an organization's AI stack. The attack didn't just steal random data. It systematically targeted the keys that unlock cloud compute, model inference, and infrastructure access.
We didn't see this coming because the industry was obsessed with model-level attacks—prompt injection, data poisoning, adversarial examples. The real attack vector was far simpler: poison the dependencies that developers trust implicitly.
The attack also fits into a larger pattern. CloudSEK's report ties this incident to a coordinated campaign by a threat actor they call "Team PCP." The same actor previously targeted Trivy (container security scanner), CanisterWorm (npm worm), Checkmarx KICS (infrastructure-as-code scanner), and Telnyx (communications API). This is not a random hacker. This is a group systematically mapping the developer toolchain and infecting it at the source.
Core: The Technical Anatomy of the Poison
Let me break down what actually happened. The malicious versions carried a file named litellm_init.pth. For non-Python readers: .pth files are processed automatically by the Python interpreter at startup. They are typically used to modify sys.path. But they can also execute arbitrary code. No import statement needed. No explicit call. Just install the package, and the code runs.
This is a well-known technique in supply chain attacks. But it's rare to see it deployed against AI infrastructure. The attacker knew exactly how Python packaging works. They exploited the implicit trust that developers place in package installation.
The payload did three things: 1. Collected credentials: SSH keys, cloud provider tokens (AWS, GCP, Azure), Kubernetes service account tokens, and LLM API keys from environment variables, config files, and credential managers. 2. Exfiltrated data: Sent everything to a domain disguised as models.litellm.cloud—a convincing typo of the legitimate models.litellm.ai. 3. Self-destructed: The malicious code did not persist. Once the data was sent, the .pth file had no further action. This minimized the footprint and made detection harder.
Based on my experience auditing smart contract deployments, I've seen this same pattern before. In DeFi, attackers frequently poison the dependency chain to steal private keys. The difference is that in AI, the stolen keys are not just for wallets. They are for cloud infrastructure, model APIs, and Kubernetes clusters. The blast radius is exponentially larger.
The speed of the attack is also telling. The packages were published, spread, and removed within 40 minutes. In that window, the attacker harvested 78,330 credentials from 2,186 organizations. That implies an automated pipeline: a bot that continuously scans PyPI for new versions of popular packages, injects the malicious .pth, and triggers the exfiltration. The attacker likely used a technique called "dependency confusion" or "typosquatting" to accelerate adoption. Or they may have compromised the PyPI upload credentials of the LiteLLM maintainer.
We still don't know how the attacker gained upload access. That is a critical missing piece. Was it a leaked API token? A phishing attack? A compromised maintainer account? Without this information, we cannot close the door to future attacks.
Contrarian: The Real Blind Spot Isn't Code—It's Trust
The mainstream narrative will focus on "audit your dependencies" and "use software composition analysis." Standard advice. But it misses the deeper point.
The package registry model is fundamentally broken for AI infrastructure. Here's why:
First, the speed of AI development demands rapid iteration. Developers install packages daily. They don't have time to audit every dependency. Even if they use SCA tools, the detection window is hours to days. The attacker only needed 40 minutes.
Second, the trust model is centralized. PyPI, npm, Maven—these are single points of failure. If an attacker compromises the upload mechanism, they can distribute malicious code to millions of users instantly. The entire ecosystem relies on the security practices of a few maintainers and the registry's own authentication. Both are fragile.
Third, the attack surface is widening. The same Team PCP also targeted Trivy and KICS. These are tools used to scan for vulnerabilities. The irony is thick: the attackers are compromising the very tools we use to protect ourselves. This is a coordinated assault on the developer trust chain.
Regulation didn't catch this because the attackers move faster than policy. MiCA and other crypto regulations have forced exchanges to implement KYC and AML. But AI infrastructure has no such guardrails. The package registries are unregulated, anonymous, and global. The attacker could be anywhere.
So what does the contrarian takeaway look like? It's not just "audit more." It's "redesign the trust model." We need to move toward: - Signed packages with hardware-backed attestation: Every upload should be signed by a hardware key that can be verified downstream. - Real-time reputation scoring: PyPI should flag new versions of popular packages that show unusual behavior, like late-night uploads or sudden changes in maintainer accounts. - Ephemeral credentials for AI pipelines: If your API keys rotate every hour, a stolen token is useless within 60 minutes. The 40-minute window becomes irrelevant.
The contrarian truth is that the attack is not about AI at all. It's about the systemic fragility of open-source distribution. We've seen this in the crypto world with npm packages targeting DeFi protocols. The same pattern is now hitting AI. The root cause is the same: trust without verification.
Takeaway: The Next Wave Will Target Agent Orchestration
This is not the end. It's the beginning.
CloudSEK explicitly warns that future attacks will target MCP servers, vector stores, and agent runtimes. These are the "connective tissue" of the agentic web. Once compromised, an attacker can inject malicious decisions into an AI agent's logic loop. The impact goes beyond data theft—it becomes manipulation of outcomes.
We didn't see the LiteLLM attack coming because we were looking at the wrong layer. The next attack will be even harder to detect. It will exploit the implicit trust in AI agent orchestration frameworks. The question is not if your AI pipeline will be compromised. It's when.
Prepare now. Enforce least privilege. Use ephemeral credentials. Treat every package installation as a potential intrusion. And most importantly, stop trusting the registry. Start verifying.
