TeamPCP - Expands Supply Chain Campaign with LiteLLM Compromise
Basically, a popular Python package was hacked to steal passwords and sensitive data.
A popular Python package, LiteLLM, was compromised by malware linked to TeamPCP. This breach could lead to significant credential theft across many systems. Organizations are urged to take immediate action to secure their environments.
The Threat
TeamPCP, a notorious threat group, has expanded its supply chain campaign by compromising the widely used LiteLLM Python package. This package, which boasts over 95 million monthly downloads, was found to contain malware designed to harvest sensitive information. The malicious versions, 1.82.7 and 1.82.8, were uploaded to the Python Package Index (PyPI) on March 24, 2026. This incident follows previous attacks linked to TeamPCP, including vulnerabilities in the Trivy vulnerability scanner and malicious Docker images.
The malware embedded in LiteLLM operates stealthily, executing automatically when certain components are imported. A more aggressive variant even activates whenever any Python process starts, allowing it to run in the background without user interaction. This capability significantly increases the risk of widespread credential theft across affected environments.
Who's Behind It
The TeamPCP group has been active in orchestrating multi-stage supply chain attacks across various developer ecosystems, including GitHub Actions, Docker Hub, and npm. Their strategy involves targeting developer and security tools that often operate with elevated privileges, making them prime candidates for credential theft. The compromised LiteLLM package is just the latest in a series of attacks that exploit vulnerabilities in popular software tools.
Brett Leatherman, an FBI Assistant Director, warned that the volume of stolen credentials could lead to numerous breach disclosures and follow-on intrusions. The attackers are deliberately focusing on tools that provide access to sensitive infrastructure, raising concerns about the potential for future attacks.
Tactics & Techniques
The malware operates in three distinct stages. Initially, it embeds a hidden payload within the package files. Once triggered, it collects sensitive data from the system, including:
- SSH keys and configuration files
- Cloud credentials from AWS, GCP, and Azure
- Kubernetes secrets and configuration files
- Database credentials
- Cryptocurrency wallets
- TLS and SSL private keys
- Shell histories and system authentication files
After gathering this information, the malware attempts to spread across Kubernetes clusters and installs a persistent backdoor, allowing attackers to maintain access to compromised systems. The stolen data is encrypted and sent to infrastructure controlled by the attackers, complicating detection efforts.
Defensive Measures
Organizations that have installed the compromised LiteLLM versions should take immediate action. It is crucial to assume that any credentials used in affected environments have been exposed. Security experts recommend:
- Rotating all secrets and credentials
- Reviewing systems for signs of compromise
- Monitoring for unusual activity within Kubernetes environments
As the landscape of supply chain attacks continues to evolve, vigilance and proactive security measures are essential. Keeping software updated and monitoring developer tools for vulnerabilities can help mitigate the risks posed by groups like TeamPCP.
Infosecurity Magazine