TeamPCP Supply Chain Attack Reaches LiteLLM as Compromised AI Proxy Package Triggers 500,000 Credential Exfiltrations
Threat actor TeamPCP used credentials stolen in the Trivy compromise to backdoor LiteLLM versions 1.82.7 and 1.82.8 on PyPI, deploying a multi-stage credential stealer across an estimated 500,000 environments.
Overview
The TeamPCP hacking group has expanded its ongoing supply chain campaign to one of the most widely used AI infrastructure packages in the Python ecosystem. On March 24, 2026, two compromised versions of the LiteLLM AI proxy library were published to PyPI, each containing a multi-stage credential stealer that harvested SSH keys, cloud tokens, Kubernetes secrets, and cryptocurrency wallets from affected systems, according to BleepingComputer.
LiteLLM, maintained by BerriAI, is an open-source proxy that provides a unified interface across more than 100 large language model providers. It is downloaded approximately 3.4 million times per day and is present in roughly 36 percent of cloud environments, according to The Hacker News. The compromised versions were available on PyPI for approximately five hours before being quarantined.
This follows earlier reporting by The Machine Herald on TeamPCP’s compromise of Aqua Security’s Trivy scanner, which has now cascaded into multiple downstream ecosystems.
How the Trivy Breach Led to LiteLLM
The LiteLLM compromise was a direct consequence of the earlier Trivy supply chain attack. LiteLLM’s CI/CD pipeline ran Trivy as part of its build process, pulling it via apt without a pinned version. The compromised Trivy action exfiltrated LiteLLM’s PyPI publishing token from the GitHub Actions runner environment, as reported by The Hacker News.
Armed with the stolen token, the attacker bypassed LiteLLM’s official CI/CD workflows and uploaded malicious packages directly to PyPI. Version 1.82.7 was published at 10:39 UTC on March 24, followed by version 1.82.8 at 10:52 UTC. Both versions were removed by approximately 16:00 UTC, according to BleepingComputer.
Payload and Capabilities
The two malicious versions used different injection techniques. Version 1.82.7 embedded a base64-encoded payload inside litellm/proxy/proxy_server.py, the standard import path for LiteLLM’s proxy server mode. Version 1.82.8 escalated the approach by installing a .pth file (litellm_init.pth) that executed automatically on every Python process startup, regardless of whether LiteLLM was explicitly imported, as reported by BleepingComputer.
Once triggered, the payload ran a three-stage attack. It first harvested credentials from more than 50 filesystem paths, targeting SSH keys, cloud provider credentials for AWS, GCP, and Azure, Kubernetes service account tokens, .env files, database passwords, TLS private keys, and cryptocurrency wallet data. It then attempted lateral movement across Kubernetes clusters by deploying privileged pods to every node. Finally, it installed a persistent systemd backdoor disguised as a “System Telemetry Service” that polled the domain checkmarx[.]zone for additional payloads, according to BleepingComputer.
Stolen data was encrypted and exfiltrated to models.litellm[.]cloud, a domain that is not affiliated with BerriAI or the legitimate LiteLLM project, as reported by BleepingComputer.
Scale of the Compromise
BleepingComputer reported that approximately 500,000 data exfiltration incidents occurred, though many may be duplicates. Given LiteLLM’s position as a middleware layer between applications and LLM providers, the stolen credentials could include API keys for commercial AI services, cloud infrastructure tokens, and database connection strings used by AI-powered applications, according to BleepingComputer.
The broader TeamPCP campaign has now spanned five ecosystems: GitHub Actions, Docker Hub, npm, VS Code extensions via Open VSX, and PyPI, according to SecurityWeek.
What We Don’t Know
Several aspects of the incident remain unclear. The exact number of unique organizations affected has not been confirmed, and BleepingComputer noted it could not independently verify the 500,000 exfiltration figure. Whether the stolen credentials have already been used in downstream attacks has not been publicly disclosed.
It is also unclear how many other open-source projects may have been similarly compromised through the Trivy CI/CD vector. Mandiant’s earlier warning that “there will likely be many other software packages” affected by the Trivy breach continues to materialize.
Remediation
Organizations using LiteLLM should audit all environments for versions 1.82.7 or 1.82.8 and revert to version 1.82.6, the latest verified clean release. All secrets, tokens, and credentials accessible from affected systems should be rotated immediately. Security teams should search for the persistence artifact litellm_init.pth, suspicious files at /tmp/pglog and /tmp/.pg_state, and unauthorized pods in the kube-system namespace. Outbound traffic to models.litellm[.]cloud and checkmarx[.]zone should be blocked, according to BleepingComputer.
BerriAI has rotated all maintainer credentials following the incident, according to BleepingComputer.