On March 24, 2026, the threat actor known as TeamPCP published two malicious versions (1.82.7 and 1.82.8) of the popular LiteLLM Python package to PyPI, leveraging credentials stolen during their prior compromise of Aqua Security's Trivy vulnerability scanner. LiteLLM is a universal LLM API proxy used in approximately 36% of cloud environments, making this a high-impact supply chain attack.

The attack represents the third phase of TeamPCP's cascading supply chain campaign. Phase one compromised Trivy's GitHub Actions on March 19, 2026 (tracked as CVE-2026-33634, CVSS 9.4), harvesting CI/CD secrets from thousands of repositories. Phase two hijacked 35 tags of the Checkmarx KICS GitHub Action on March 23, 2026, along with the ast-github-action, OpenVSX extensions, and npm packages. Phase three targeted LiteLLM's PyPI distribution directly.

The root cause was an incompletely-rotated GitHub personal access token exposed during the Trivy compromise. LiteLLM's CI/CD pipeline incorporated Trivy for security scanning via an unpinned installation script (ci_cd/security_scans.sh), which allowed the poisoned Trivy payload to harvest PyPI publishing credentials. The attacker then published directly to PyPI, bypassing GitHub CI/CD entirely.

Version 1.82.7 embedded a base64-encoded payload within litellm/proxy/proxy_server.py, activated upon importing the proxy module. Version 1.82.8 escalated to a more aggressive vector: a 34,628-byte .pth file (litellm_init.pth) placed in the Python site-packages directory. Python's site.py processes .pth files at interpreter startup, meaning the malware executes on every Python process in the environment without requiring any import of the litellm package. The .pth file spawns a detached child process via subprocess.Popen containing a double base64-encoded payload.

The payload operates in three stages. Stage one is a credential harvester that sweeps SSH keys, environment variables, AWS/GCP/Azure cloud credentials, Kubernetes configurations and secrets (across all namespaces), CI/CD secrets, Docker registry credentials, database passwords, SSL private keys, shell history, .env files, cryptocurrency wallets, and even password hashes from /etc/shadow. On GitHub Actions runners, it accesses process memory via /proc/[PID]/mem to dump Runner.Worker components and extract JSON-flagged secrets.

Stage two is a Kubernetes lateral movement toolkit. It leverages the host's service account token to enumerate all cluster nodes, then deploys privileged pods (named node-setup-{node_name}, alpine:latest image) to every node in the kube-system namespace with host filesystem mounting enabled. It then chroots into the host filesystem and installs the persistence dropper.

Stage three is a persistent systemd backdoor. The sysmon.py script is installed at ~/.config/sysmon/sysmon.py with a systemd user service (sysmon.service, described as 'System Telemetry Service') that polls checkmarx.zone/raw every 50 minutes for next-stage payload URLs. It includes a kill-switch pattern that aborts if the response URL contains 'youtube.com'.

All harvested data is encrypted using AES-256-CBC with PBKDF2 key derivation (32-byte session key generated via openssl rand), then the session key is wrapped with an RSA-4096 public key (OAEP padding) hardcoded in the malware. The encrypted archive (tpcp.tar.gz) is exfiltrated via HTTPS POST to models.litellm.cloud. The same RSA public key was reused from the Trivy and KICS campaigns, providing high-confidence attribution to TeamPCP.

PyPI quarantined the malicious packages approximately 2 hours 55 minutes after publication (11:25 UTC). The entire litellm package was subsequently suspended. The LiteLLM team (BerriAI) rotated all maintainer accounts, engaged Google Mandiant for incident response, and halted releases pending a full supply chain audit. Docker Proxy image users were unaffected as dependencies were pinned in requirements.txt.

TeamPCP communicated via Telegram channels (@Persy_PCP, @teampcp), taunting victims: 'These companies were built to protect your supply chains yet they can't even protect their own.' The group claims partnerships with additional teams for ongoing attacks, indicating this campaign may continue to expand.