Supply-chain attacks targeting widely utilized open-source AI packages — exemplified by documented attacks on the LiteLLM framework — represent extreme systemic risk: a single compromised foundational code repository instantly and autonomously infects ...

Supply-chain attacks targeting widely utilized open-source AI packages — exemplified by documented attacks on the LiteLLM framework — represent extreme systemic risk: a single compromised foundational code repository instantly and autonomously infects thousands of downstream enterprise agent networks at machine speed, bypassing traditional firewall perimeters entirely. | Next major AI-package supply chain CVE

Key catalyst: Next major AI-package supply chain CVE

Watch events: PyPI/npm AI-package attack incidents; enterprise SBOM mandates

LiteLLM CVE-2024/2025 disclosures documented; PyPI / npm AI-package supply-chain attacks increasing 2024-2026. Snyk, Socket.dev reporting sharp rises.

Beneficiaries (13)

{
  "nia": false,
  "mode": "FORECAST",
  "role": "Cited-Other",
  "context": "Specific vector extending 231_017 (Wissner-Gross: major supply chain attack from untrusted open-weight models is expected). LiteLLM is named vulnerable component.",
  "to_year": 2028,
  "conv_cues": "specific named framework vulnerability; severe framing",
  "direction": "HAPPEN",
  "from_year": 2026,
  "timeframe": "2026-2028",
  "conv_level": "HIGH",
  "milestones": [
    {
      "kind": "llm_pre_event",
      "label": "CVE-2026-33634 issued for upstream Trivy / TeamPCP campaign",
      "notes": "HIT — CVE-2026-33634 with CVSS 9.4. Trivy → LiteLLM cascade was attack mechanism.",
      "source": "https://www.kaspersky.com/blog/critical-supply-chain-attack-trivy-litellm-checkmarx-teampcp/55510/",
      "status": "hit",
      "weight": 0.4,
      "ordinal": -8,
      "source_id": null,
      "confidence": 0.95,
      "source_url": "https://www.kaspersky.com/blog/critical-supply-chain-attack-trivy-litellm-checkmarx-teampcp/55510/",
      "expected_date": "2026-03-01",
      "observed_date": "2026-03-01",
      "research_origin": "deep_research",
      "measurement_criterion": "MITRE/NVD assigns CVE with CVSS ≥9.0 for AI-toolchain supply-chain attack with documented downstream cascade"
    },
    {
      "kind": "llm_pre_event",
      "label": "LiteLLM PyPI supply-chain compromise (versions 1.82.7, 1.82.8)",
      "notes": "HIT — exactly the event Wissner-Gross referenced. LiteLLM downloaded 3.4M times/day, ≥20K downstream repos potentially exposed.",
      "source": "https://docs.litellm.ai/blog/security-update-march-2026 — LiteLLM 1.82.7/1.82.8 compromised March 24 2026",
      "status": "hit",
      "weight": 0.4,
      "ordinal": -7,
      "source_id": null,
      "confidence": 0.99,
      "source_url": "https://docs.litellm.ai/blog/security-update-march-2026",
      "expected_date": "2026-03-24",
      "observed_date": "2026-03-24",
      "research_origin": "deep_research",
      "measurement_criterion": "Documented compromise of widely-used AI package on PyPI/npm with confirmed downstream propagation"
    },
    {
      "kind": "llm_pre_event",
      "label": "Three-stage payload hits credential / Kubernetes / backdoor at scale",
      "source": "https://www.helpnetsecurity.com/2026/03/25/teampcp-supply-chain-attacks/",
      "status": "hit",
      "weight": 0.4,
      "ordinal": -6,
      "source_id": null,
      "confidence": 0.99,
      "source_url": "https://www.helpnetsecurity.com/2026/03/25/teampcp-supply-chain-attacks/",
      "expected_date": "2026-03-24",
      "observed_date": "2026-03-24",
      "research_origin": "deep_research",
      "measurement_criterion": "Compromised package shown to deploy credential harvester targeting ≥50 secret types + lateral-movement toolkit + persistent backdoor"
    },
    {
      "kind": "quartile_checkpoint",
      "label": "Q1 window check-in (25%)",
      "status": "pending",
      "weight": 0.05,
      "ordinal": -5,
      "source_id": null,
      "expected_date": "2026-07-21",
      "observed_date": null
    },
    {
      "kind": "llm_pre_event",
      "label": "Second wave of AI-package supply-chain CVE during 2026",
      "source": "TeamPCP campaign tracked as 'Phase 09' — implies further phases pending; Wiz/Snyk/Kaspersky monitoring",
      "status": "pending",
      "weight": 0.4,
      "ordinal": -4,
      "source_id": null,
      "confidence": 0.75,
      "source_url": "https://snyk.io/blog/poisoned-security-scanner-backdooring-litellm/",
      "expected_date": "2026-09-15",
      "research_origin": "deep_research",
      "expected_date_range": {
        "to": "2026-12-31",
        "from": "2026-06-01"
      },
      "measurement_criterion": "≥1 additional widely-deployed AI/agent package compromised at PyPI/npm scale during 2026, after LiteLLM"
    },
    {
      "kind": "quartile_checkpoint",
      "label": "Q2 window check-in (50%)",
      "status": "pending",
      "weight": 0.05,
      
... (truncated)