The event: February 4, 2025. A malicious package named LiteLLM hits PyPI. It carries a .pth file that executes automatically on Python interpreter startup—no import needed. In 40 minutes, it exfiltrates 78,330 credentials from 2,186 organizations. SSH keys, AWS/GCP/Azure tokens, Kubernetes secrets, LLM API keys. The exfiltration domain: models.litellm.cloud—a near-perfect clone of the legitimate domain. Speed is the only metric that survives the crash. This attack is not novel in technique. It is novel in target. The credential layer of AI agent infrastructure has been compromised.
Context: LiteLLM is the de facto open-source gateway for routing requests to over 100 LLM providers. It manages the very API keys that allow agents to think, decide, and execute. If you are a crypto project using AI agents for trading, governance, or analytics, you are likely using LiteLLM or a derivative. The attack vector is the package registry—the most trusted layer in the software supply chain. In DeFi, we learned that a single compromised oracle can drain a protocol. Here, the oracle is the dependency manager. The attack is part of a larger campaign by Team PCP, which also targeted Trivy, CanisterWorm npm, Checkmarx KICS, and Telnyx. This is a systematic mapping of the developer toolchain. The floors we thought were solid are illusions until the bot sees the spread.
Core: Let me break down the technical execution. The .pth file mechanism is well-known in Python circles: place a file in site-packages/ with a .pth extension, and Python will execute its contents on startup. The attacker used this to run a payload without any code change in the source. The credential collection covered the full spectrum of cloud-native operations: SSH for machine access, cloud provider tokens for infrastructure control, K8s tokens for orchestrator access, and LLM API keys for model consumption. This is not a random grab bag. It is a calculated harvest of the credentials needed to pivot across an AI agent’s entire lifecycle. Based on my own experience monitoring package registries, the 40-minute window and the two consecutive versions (1.82.7, 1.82.8) suggest an automated publishing pipeline. The attacker likely had control over the PyPI account or used a dependency confusion attack. In my audit of the Hard Hat Protocol, I had to manually trace staking logic to find a critical overflow. Here, the attack vector is more insidious because it exploits the trust in the build system itself. The 78,330 keys stolen in 40 minutes implies a high-speed exfiltration pipeline, likely triggered as soon as CI/CD systems pulled the malicious package. The article connects this to the CoreBreak framework attack, Cloudflare MCP detection, and AWS AgentCore bypass. These are not isolated events. They are arcs of a planned assault on the agent infrastructure stack.
Contrarian: The conventional wisdom is that supply chain attacks are about code injection. But the real blind spot here is the assumption that AI agent infrastructure is separate from traditional infrastructure. It is not. The same SSH keys that secure a cloud instance also secure the training data. The same K8s tokens that orchestrate containers also orchestrate the agent’s model selection. The attacker understood this convergence. The crypto community often obsesses over on-chain smart contract vulnerabilities, but ignores the off-chain tooling that connects to the chain. LiteLLM is used by many Web3 projects to route AI queries for on-chain data analysis. The attack exposes that the “off-chain” is the new on-chain in terms of attack surface. Another contrarian point: open-source is often hailed as more secure due to “many eyes.” But LiteLLM is maintained by a small team. The response to the attack was not immediate. The package was up for 40 minutes before removal. The many eyes were not watching the registry. The idea that open-source automatically provides security is a fallacy. The attack proves that the most trusted layer—the dependency registry—is the most fragile. Speed is the only metric that survives the crash. The 40-minute window is the delta between trust and compromise.
Takeaway: This event is a signal. The market will now price in the cost of supply chain audits for AI infrastructure. For those running AI agents in production, the next step is not just rotating keys. It is implementing immutable package pinning, runtime attestation, and real-time credential monitoring. The question is: will your protocol survive the next 40-minute window? The attack on LiteLLM is a warning shot across the bow of every organization that integrates AI agents into their stack. The floors are illusions until the bot sees the spread. The bot has seen the spread. The question is: what will you do in the next 40 minutes?