Compromised LiteLLM Package With 95M Downloads Tied to TeamPCP, After Trivy & KICS Hacks

Security researchers discovered that the popular Python library litellm was compromised on PyPI.

With over 95 million monthly downloads, this open-source tool helps developers route requests across various LLM providers through a single API.

The threat actor, identified as TeamPCP, injected malicious code into versions 1.82.7 and 1.82.8.

This devastating supply chain attack directly follows the group’s recent high-profile compromises of Aqua Security’s Trivy and Checkmarx’s KICS.

The group is notorious for targeting open-source ecosystems, having previously deployed worms such as CanisterWorm to steal tokens via compromised npm accounts.

The Infection Chain

The attackers used two distinct methods to trigger the malware. In version 1.82.7, they injected 12 lines of hidden base64 code into the proxy_server.py file.

To evade static analysis tools, they avoided common red flags like exec(), instead writing a decoded script to a temporary file and executing it via a subprocess. This payload executes the moment a developer imports the library.

Version 1.82.8 is far more aggressive. It includes a malicious litellm_init.pth file placed at the root of the installation.

Because of how Python automatically processes .pth files at interpreter startup, the malware silently launches a detached Python process in the background whenever any Python script runs in that environment.

This means the malware activates even if litellm itself is never explicitly imported by the user.

The Three-Stage Payload

Once triggered, the malware launches a highly sophisticated three-stage attack:

Stage 1: Orchestrator

The orchestrator decodes the hidden scripts and prepares to exfiltrate data. It encrypts stolen files using a robust AES-256-CBC and RSA-4096 scheme, bundles them into an archive named tpcp.tar.gz, and sends them to an attacker-controlled domain masquerading as a legitimate project site (models.litellm.cloud).

Stage 2: Credential Harvester and Lateral Movement

The malware aggressively sweeps the compromised system for sensitive data. It targets SSH keys, AWS/GCP/Azure cloud tokens, CI/CD secrets, .env files, and cryptocurrency wallets.

The harvester even implements full AWS SigV4 signing to pull data directly from AWS Secrets Manager.

 If it finds a Kubernetes service account token, it deploys highly privileged pods to every node in the cluster, mounting the entire host filesystem to take full administrative control.

Stage 3: Persistent Backdoor

Finally, the malware installs a systemd user service called “System Telemetry Service.” This backdoor masquerades as a PostgreSQL process (/tmp/pglog) to hide in process listings.

It contacts the attacker’s command and control (C2) server every 50 minutes to download additional payloads, checking against a local state file and a “youtube.com” kill switch before execution.

This breach is part of a massive, month-long supply chain campaign by TeamPCP. The group has systematically targeted security and developer tools because these environments hold valuable administrative credentials.

By stealing secrets from one compromised system, they pivot to attack the next. Their targets have rapidly crossed GitHub Actions, Docker Hub, npm packages, OpenVSX, and now PyPI.

According to Endor Labs, the mere 13-minute gap between releasing version 1.82.7 and the deadlier 1.82.8 shows the attackers are actively iterating their malware in real-time.

Affected Versions and Indicators

Organizations using litellm should immediately verify their environments and look for the following indicators of compromise:

• Malicious Versions: litellm 1.82.7 and 1.82.8 (Published March 24, 2026, and subsequently removed from PyPI).
• Safe Version: Roll back to litellm 1.82.6, which has been verified as clean by security researchers.
• Command and Control (C2) Domains: Block models.litellm.cloud and checkmarx.zone at your network perimeter.
• Malicious Files: Check for the presence of ~/.config/sysmon/sysmon.py and ~/.config/systemd/user/sysmon.service.
• Exfiltration Artifacts: Look for the unauthorized creation of tpcp.tar.gz archives in temporary directories.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.