TeamPCP Supply Chain Attack Poisons LiteLLM PyPI Packages
Threat actor TeamPCP compromised LiteLLM versions 1.82.7 and 1.82.8 on PyPI, deploying a multi-stage credential stealer that harvests cloud keys, SSH tokens, and Kubernetes secrets. Any developer who ran pip install litellm on March 24 during a three-hour window is at risk.
On March 24, 2026, between 10:39 UTC and approximately 13:39 UTC, the threat actor group TeamPCP published two backdoored releases of the LiteLLM Python package to PyPI: versions 1.82.7 and 1.82.8. PyPI quarantined the packages roughly three hours after upload, but not before a significant window of exposure.
LiteLLM is an open-source proxy layer used by thousands of AI teams to route requests across OpenAI, Anthropic, AWS Bedrock, and other LLM providers. Compromising it is an ideal supply chain target — a single poisoned package grants access to every API key the host system can reach.
How the Attack Worked
The root of the compromise was a hijacked Trivy CI/CD GitHub Action inside LiteLLM’s own pipeline. TeamPCP first poisoned the Trivy security scanner (CVE-2026-33634), gained access to the LiteLLM maintainer’s PyPI publishing credentials, then bypassed the official release workflow to push malicious builds directly.
Version 1.82.7 contained the malicious payload inside the package source. Version 1.82.8 went further: it dropped a .pth file (litellm_init.pth) that gets auto-executed by Python’s import machinery on every interpreter startup, even in environments that don’t explicitly import litellm.
Once executed, the malware:
- Collected environment variables, SSH keys, shell history, Docker configs, and CI/CD secrets
- Targeted cloud credentials for AWS, GCP, and Azure
- Exfiltrated Kubernetes service account tokens — and could escalate to cluster-wide compromise by spawning privileged
node-setup-*pods - Encrypted stolen data with AES-256 + RSA-4096 before sending it to
models.litellm[.]cloud(not an official LiteLLM domain) - Installed persistence via a systemd user service at
~/.config/systemd/user/sysmon.service
The same TeamPCP campaign simultaneously targeted telnyx v4.87.1 and v4.87.2, using a different exfiltration technique: steganographic payloads hidden inside WAV audio files.
Real-World Impact
Mercor, an AI recruiting startup, confirmed a breach directly linked to this campaign. The Lapsus$ group claimed responsibility for stealing data from Mercor’s systems. Mercor was among companies running LiteLLM as infrastructure.
CISA added the related Langflow flaw (CVE-2026-33017, CVSS 9.3) — which enabled earlier stages of the TeamPCP cascade — to its Known Exploited Vulnerabilities catalog on March 25, 2026.
What to Do Right Now
Affected versions: litellm 1.82.7 and 1.82.8
If you ran pip install litellm or received an unpinned upgrade on March 24, 2026, treat your environment as fully compromised.
- Rotate everything immediately: API keys (OpenAI, Anthropic, AWS, GCP, Azure), database passwords, SSH keys, Kubernetes tokens, and any secrets visible in your environment variables or CI/CD logs.
- Downgrade or upgrade: Roll back to
litellm==1.82.6or upgrade tolitellm>=1.83.0(verified clean). - Search for persistence: Check for
litellm_init.pthin your Pythonsite-packagesand for~/.config/systemd/user/sysmon.service. - Audit Docker images: Official LiteLLM Docker images used pinned dependencies and were not affected. Custom images that installed via pip may be.
- Check CI/CD logs: LiteLLM has published community scripts for GitHub Actions and GitLab to scan for signs of compromise.
Docker users who pulled the official LiteLLM container image are not affected. The vulnerability is specific to direct pip install consumers.
The TeamPCP campaign is still active. Pin your AI SDK dependencies.