AI gateway supply chain attack: backdoored releases targeted cloud secrets

What happened

An AI gateway supply chain attack in March 2026 hit a component that sits between applications and model providers and usually holds keys for all of them.

LiteLLM, an open-source AI gateway, says two releases published to PyPI, versions 1.82.7 and 1.82.8, contained malicious code. They were live on March 24, 2026, “from 10:39 UTC for about 40 minutes before being quarantined by PyPI.” LiteLLM says its evidence suggested a maintainer’s PyPI account may have been compromised, and it believes the compromise originated from the Trivy dependency used in its CI/CD security-scanning workflow. According to LiteLLM, the malicious versions appear to have included a credential stealer designed to harvest environment variables, SSH keys, cloud provider credentials, Kubernetes tokens, and database passwords, and send them to a domain that was not LiteLLM’s. LiteLLM says customers running its official proxy Docker image were not affected, because that image pins its dependencies. It later released a clean version built through a new release pipeline.

Datadog Security Labs places the incident in a broader campaign. In its timeline, the Trivy security scanner was compromised on March 19, the activity then reached Checkmarx and OpenVSX artifacts, LiteLLM was hit on March 24, and the Telnyx package on PyPI followed on March 27. Datadog advises defenders to treat any host or CI job that installed the affected versions “as a full-credential exposure event.”

Why it matters to leaders (our analysis)

AI gateways and model-routing libraries are often added quickly, by product teams, as plumbing. They end up holding model API keys alongside cloud, database, and Kubernetes credentials, which makes one poisoned release unusually valuable to an attacker. These releases were live for only about 40 minutes, which is enough for unpinned installs and automated builds to pull them in, and LiteLLM says pinned dependencies kept at least one deployment path unaffected.

It also shows how compromises chain: according to LiteLLM and Datadog, credentials taken through one project’s security tooling became the way into the next. Leaders should make sure AI middleware sits inside the same supply chain controls as any other critical dependency, with pinned versions, internal mirrors, minimal secrets, and a rotation plan that assumes everything the host could reach is exposed.