CampaignPublished 27 Mar 2026

AI Infrastructure Supply Chain Poisoning Alert

Source AlienVault OTX General

Description

A supply chain poisoning attack on LiteLLM, a popular AI model gateway, was detected by NSFOCUS Technology CERT. The TeamPCP group compromised the Trivy security scanning tool used in LiteLLM's release process, allowing them to publish malicious versions 1.82.7 and 1.82.8 on PyPI. These versions contained credential-stealing programs that collected sensitive data and, if a Kubernetes cluster was detected, deployed privileged Pods and implanted persistent backdoors. The attack impacted numerous dependent packages and potentially affected millions of users. The incident highlights the growing risks in AI infrastructure and the need for robust supply chain security measures.

Impact

This supply chain poisoning attack poses a substantial risk to organizations globally, particularly those utilizing LiteLLM or its dependent packages in their AI infrastructure. Credential theft can lead to unauthorized access to sensitive systems and data, increasing the risk of data breaches and intellectual property theft. The deployment of privileged Pods within Kubernetes clusters can result in full cluster compromise, enabling attackers to move laterally, escalate privileges, and maintain persistent access. Given the widespread use of PyPI packages and the popularity of Kubernetes in cloud-native environments, the attack could affect millions of users and organizations, disrupting AI services and potentially causing operational downtime. The persistent backdoors implanted by the malware complicate detection and remediation efforts, increasing the likelihood of prolonged exposure. This incident also erodes trust in open-source supply chains, potentially impacting software development and deployment practices across industries. The attack could have cascading effects on AI-driven applications, critical infrastructure, and enterprises relying on AI model gateways, amplifying the overall threat landscape.

Defensive guidance

Organizations should immediately audit their environments for the presence of Trivy versions 1.82.7 and 1.82.8 and any dependent packages that might have been compromised. Remove and replace these versions with verified clean releases. Implement strict supply chain security measures including cryptographic verification of software packages and dependencies before deployment. Employ runtime security controls and monitoring within Kubernetes clusters to detect anomalous privileged Pod deployments and unusual network activity indicative of backdoors. Use tools that can detect credential theft attempts and unusual authentication patterns. Enforce least privilege principles for Kubernetes service accounts and restrict Pod privileges to minimize attack surface. Regularly update and patch all components in the AI infrastructure and maintain an inventory of third-party dependencies. Establish incident response plans specifically addressing supply chain attacks and conduct threat hunting exercises focusing on persistence mechanisms. Collaborate with open-source communities and security vendors to share intelligence and receive timely alerts about compromised packages. Consider adopting software bill of materials (SBOM) practices to improve visibility into software supply chains.

Indicators of compromise

Hashes 6

97e073abd819d9cdc07705aeaa481f59
78cd382040eda14e2f8a17ee7387cffdabe96ab5
71e35aef03099cd1f2d6446734273025a163597de93912df321ef118bf135238
8395c3268d5c5dbae1c7c6d4bb3c318c752ba4608cfcd90eb97ffb94a910eac2
a0d229be8efcb2f9135e2ad55ba275b76ddcfeb55fa4370e0a522a5bdee0120b
d2a0d5f564628773b6af7b9c11f6b86531a875bd2d186d7081ab62748a800ebb

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 27 Mar 2026, 20:01 UTC

MITRE ATT&CK techniques16 from threat tags

Technical details

Indicators of compromise

Hashes 6

Community reviews

Related threats