LiteLLM AI proxy package Remote Code Execution Vulnerability

TeamPCP orchestrated a sophisticated supply chain attack, compromising the Trivy security scanner's CI/CD pipeline to publish malicious versions of the LiteLLM AI proxy package to PyPI. These trojanized versions deployed a multi-stage payload for credential harvesting, Kubernetes lateral movement, and persistent remote code execution.

What Happened

TeamPCP orchestrated a sophisticated supply chain attack, compromising the Trivy security scanner's CI/CD pipeline to publish malicious versions of the LiteLLM AI proxy package to PyPI. These trojanized versions deployed a multi-stage payload for credential harvesting, Kubernetes lateral movement, and persistent remote code execution.

Why This Matters

Publisher reporting describes a security event affecting Was. BugSkan could not yet bind a CVE or affected version, so treat the source details as the current record.

Recommended Action

Confirm whether Was is present in your environment and review vendor guidance for this report. Apply available patches or mitigations if your deployment matches the described conditions.

Exposure

Exposure reason: This incident does not currently match a technology in My Interests.

Exploitation status: UNKNOWN

Primary entities:

Timeline

• Incident first seen
  Mar 26, 2026 05:30

  BugSkan first recorded this incident.

• Your AI Gateway Was a Backdoor: Inside the LiteLLM Supply Chain Compromise - www.trendmicro.com
  Mar 26, 2026 05:30

  trendaisecurity.com · Malware

Sources

Related Incidents

Other BugSkan incidents that share identifiers, products, or vendors with this report.

My Interests Match