CloudSEK says a dataset built from roughly 434,000 files maps potential exposure to more than 2,500 organizations — but those totals are not a victim count, the company and reporting make clear.
What the malicious LiteLLM releases did, and when
Two compromised LiteLLM packages, versions 1.82.7 and 1.82.8, sat on PyPI on March 24. LiteLLM identified the packages as live from 10:39 UTC for about 40 minutes before PyPI quarantined them, and advised teams to treat any install that day up to 16:00 UTC as suspect. The malicious builds were designed to harvest environment variables, SSH keys, cloud credentials, Kubernetes tokens and database passwords, then encrypt and send the captured data to an attacker-controlled domain, models.litellm[.]cloud.
Version 1.82.8 included a file named litellm_init.pth that Python processes at interpreter startup, allowing the payload to run whenever a Python process started in that environment — whether or not anything imported LiteLLM. Unit 42's analysis records the malware reading environment variables that hold model API keys, including OPENAI_API_KEY and ANTHROPIC_API_KEY.
CloudSEK's dataset: scope, caveats and confidence labels
Threat intelligence firm CloudSEK obtained a corpus it says was built from roughly 434,000 files the attackers captured and published a public, searchable lookup keyed by organization name or domain and filterable by confidence. Each row lists an organization's name and domain, a count of secrets exposed, a count of runs, and a High or Medium confidence label.
CloudSEK cautions that the numbers represent material taken from the campaign — "the files were taken, in other words" — not an independent tally of victims. High-confidence matches require identity signals from captured CI runner environments, chiefly host identity and legitimate committer domains, and the organization's own domain must appear for the top rating. Matches based only on repository namespaces are limited to Medium confidence. The published list includes entries such as NVIDIA, Cisco, Deloitte, Volkswagen, FedEx, Siemens and X Corp, though CloudSEK and other reporting stress that inclusion does not establish that stolen credentials were used.
The 434,000 figure counts captured files and exfiltration events rather than distinct pipelines or unique jobs; CloudSEK said one captured file is roughly one job execution but that the dataset is not presented as deduplicated unique jobs.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleTeamPCP, Trivy, and the chain to PyPI
The LiteLLM compromise sits inside a broader TeamPCP supply-chain campaign linked to Aqua Security's Trivy scanner. Aqua reported attackers retained access after an incomplete credential rotation and, on March 19, force-pushed malicious commits to 76 of 77 trivy-action version tags and all seven setup-trivy tags while publishing a malicious Trivy 0.69.4 release.
Google tracks TeamPCP as UNC6780. The campaign is recorded as CVE-2026-33634 and was added to CISA's Known Exploited Vulnerabilities catalog on March 26; the CVE entry now lists BerriAI LiteLLM 1.82.7 through 1.82.8 as affected alongside the Trivy components. Published accounts differ on exactly how the poisoned LiteLLM releases reached PyPI: CloudSEK describes a poisoned build producing and publishing the releases, LiteLLM's incident report points to a direct PyPI upload that bypassed its CI/CD workflow, and Unit 42 described attackers targeting PyPI publishing tokens after the Trivy breach. PyPA's advisory lays out the same sequence CloudSEK and others describe: an API token exposed through the compromised Trivy dependency was used to upload the two malicious LiteLLM versions.
CloudSEK pushed back on the notion that these are competing explanations, telling The Hacker News: "These are different stages of the same attack chain, not competing explanations." The company said its evidence covers how the credential was obtained while other reports cover how it was used.
Confirmed knock-on effects and government advisories
Even accepting CloudSEK's caveats, downstream impact has been confirmed. Checkmarx said credentials obtained through the Trivy attack enabled unauthorized access to its GitHub repositories and the publication of malicious artifacts. Mercor said it was affected by malicious LiteLLM versions and contained unauthorized activity. CERT-EU assessed with high confidence that a European Commission AWS account was compromised through the Trivy supply-chain attack, with about 91.7 GB of compressed data exfiltrated.
The FBI warned in a July 2 advisory, FLASH-20260702-01, that affiliated actors are likely to weaponize credentials exfiltrated during the TeamPCP campaign long after the initial compromise, and instructed organizations to rotate CI/CD secrets, publishing tokens and cloud credentials accessible during the relevant exposure windows. The FBI and Aqua both urged teams to move away from long-lived tokens toward temporary ones; reporting emphasizes that a long-lived secret copied during the exposure window — a static cloud key, an SSH key, or a publishing token — remains usable unless it has since been rotated or revoked.
How security teams, open-source maintainers, and regulators should respond
- Security teams: Follow the three concrete steps provided in public advisories — check for LiteLLM 1.82.7 or 1.82.8 installations during LiteLLM's March 24 audit window of 10:39 to 16:00 UTC; rotate any secrets those systems could access; and search GitHub organizations for repositories named tpcp-docs or docs-tpcp (Aqua notes the malware created repositories with a tpcp-docs- prefix and uploaded stolen data as release assets tagged data-<timestamp>, so exact-name searches can miss them).
- Open-source maintainers and package repositories: Note the PyPA advisory's reconstruction tying an exposed API token in a compromised dependency to the package uploads; maintainers should treat exposed publishing tokens and transitive, unpinned dependencies as critical attack vectors.
- Regulators and incident response coordinators: The inclusion of the campaign in CISA's Known Exploited Vulnerabilities catalog and the FBI FLASH advisory frame this as a long-lived credential risk that will demand coordinated rotation and validation of secrets across CI/CD pipelines and cloud environments.
The record assembled so far ties a Trivy supply-chain compromise to short-lived malicious LiteLLM releases that ran code capable of wide-ranging credential theft, and it leaves a simple, urgent choice for teams with exposure: assume any long-lived secret present in the March windows was copied, rotate it, and hunt for the tpcp-docs indicators. Whether every entry in the CloudSEK lookup corresponds to active misuse remains unresolved, but published confirmations from Checkmarx, Mercor and CERT-EU underline that the campaign's effects were not merely hypothetical.
