# LiteLLM PyPI backdoored as TeamPCP cascade reaches Python

> TeamPCP used credentials harvested from the Trivy compromise to publish trojanised `litellm` 1.82.7 and 1.82.8 to PyPI on 24 March 2026 (~10:39 and 10:52 UTC). Malicious wheels drop a `litellm_init.pth` file in site-packages, executing a credential stealer at every Python interpreter start. PyPI quarantined the packages ~40 minutes after publication. Attackers later claimed ~500,000 credentials from this single compromise. LiteLLM averages ~3M daily downloads and ships in ~36% of cloud environments.

- Published: 2026-03-24
- Severity: critical
- Kind: Compromise - A legitimate, already-used package, maintainer account, CI pipeline, or release tag was hijacked and a malicious version was published under a name people already depend on.
- Ecosystems: PyPI
- Scope: 1 package, 2 compromised versions
- Tags: credential-theft, infostealer, ci-cd-compromise, maintainer-takeover
- Threat actor: TeamPCP
- Also known as: TeamPCP LiteLLM cascade
- Detected by: PyPI Security, JFrog, Microsoft Threat Intelligence
- Incident ID: pypi-2026-03-24-litellm-teampcp

## Affected packages (1)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [litellm](https://dependencywatch.io/package/pypi/litellm) | PyPI | 1.82.7, 1.82.8 |

## What happened

On `2026-03-24` at approximately `10:39 UTC` and `10:52 UTC`, **TeamPCP** published trojanised `litellm` versions `1.82.7` and `1.82.8` to PyPI. Access was obtained using a BerriAI maintainer token harvested from the upstream Trivy compromise on `2026-03-19`. PyPI quarantined the releases roughly `40` minutes after the first publication, but `litellm` averages `~3M` daily downloads and is present in an estimated `~36%` of cloud environments running LLM workloads, so the practical exposure is large.

## Persistence trick

The malicious wheels include a `litellm_init.pth` file alongside the legitimate code. Python's `site` module executes `.pth` files at every interpreter start, so the stealer runs whenever *any* Python script on the host starts - not only on `import litellm`. The implant also writes a `sysmon.service` user systemd unit, drops binaries at `/tmp/pglog`, and stages payloads in `~/.config/sysmon/`.

## Capabilities

- Harvests environment variables, SSH keys, `~/.aws/`, `~/.config/gcloud/`, Azure CLI tokens, kubeconfigs, and discovered DB password files.
- On detected Kubernetes hosts, deploys privileged pods named `node-setup-*` in `kube-system` for cluster-wide lateral movement.
- Exfiltrates to `models.litellm.cloud` (a typosquat of the legitimate `litellm.ai`) with `checkmarx.zone` as fallback.

## Scale

TeamPCP later claimed `~500,000` credentials harvested across the broader cascade, with LiteLLM described as the highest-yield single hop because `.pth` execution snares secrets from any unrelated Python tooling on the same host. PyPI, BerriAI, and JFrog jointly published IoCs and a remediation playbook on `2026-03-24` and `2026-03-25`.

## Impact

- Env vars, SSH keys, AWS/GCP/Azure credentials, K8s tokens, DB passwords harvested
- .pth file ensures execution on every interpreter init, not only on install
- Privileged K8s pod deployment for cluster-wide lateral movement
- systemd user persistence (sysmon.service)

## What to do

1. Downgrade to `litellm` ≤ `1.82.6` or upgrade to a clean post-incident release
2. Delete `litellm_init.pth` from site-packages and rotate every reachable secret
3. Remove the `sysmon.service` systemd user unit and `/tmp/pglog`, `~/.config/sysmon/`
4. Remove rogue `node-setup-*` pods in `kube-system` and rotate cluster credentials
5. Block `models.litellm.cloud` and `checkmarx.zone` at the network edge

## Check your own dependencies

- Check a requirements.txt against this incident: https://dependencywatch.io/check/requirements-txt

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [LiteLLM Security Update - March 2026 Compromise](https://docs.litellm.ai/blog/security-update-march-2026) - LiteLLM
- [Detecting, investigating, and defending against the Trivy supply chain compromise](https://www.microsoft.com/en-us/security/blog/2026/03/24/detecting-investigating-defending-against-trivy-supply-chain-compromise/) - Microsoft
- [Popular litellm Python package is the latest victim of TeamPCP's ongoing supply chain attack](https://research.jfrog.com/post/litellm-compromised-teampcp/) - JFrog

---

Canonical page: https://dependencywatch.io/incident/pypi-2026-03-24-litellm-teampcp
Markdown version: https://dependencywatch.io/incident/pypi-2026-03-24-litellm-teampcp.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).