LiteLLM Supply Chain Compromise — TeamPCP Multi-Ecosystem Campaign via Trojanized PyPI Packages — Threadlinqs Intelligence
As of 2026-05-30, LiteLLM Supply Chain Compromise — TeamPCP Multi-Ecosystem Campaign via Trojanized PyPI Packages is a critical-severity supply chain threat attributed to TeamPCP (Russia), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 52 indicators of compromise.
Threat ID: TL-2026-0290 · Severity: CRITICAL · CVSS: 9.8 · Status: MONITORING · Category: SUPPLY_CHAIN
Attribution: TeamPCP · Russia · FINANCIAL
TeamPCP compromised LiteLLM versions 1.82.7 and 1.82.8 on PyPI through a cascading supply chain attack originating from a Trivy CI/CD pipeline breach. The three-stage payload harvested credentials
On March 24, 2026, threat actor TeamPCP published trojanized versions of LiteLLM (1.82.7 and 1.82.8) to PyPI, marking the culmination of a month-long multi-ecosystem supply chain campaign that previously compromised Aqua Security's Trivy, Checkmarx KICS, npm packages, Docker Hub images, and VS Code extensions.
## Attack Origin — Trivy CI/CD Breach
The campaign began on February 28, 2026, when TeamPCP (operating as 'hackerbot-claw') exploited a misconfigured pull_request_target workflow in Aqua Security's Trivy repository. This allowed them to steal an organization-scoped Personal Access Token (ORG_REPO_TOKEN) belonging to the aqua-bot service account, which had permissions across 33+ workflows. Using this stolen token, TeamPCP force-pushed malicious commits to 75 of 76 trivy-action release tags and all 7 setup-trivy tags on March 19, 2026. The compromised GitHub Actions extracted secrets from runner memory by reading /proc/<pid>/mem on GitHub-hosted runners.
## Cascading Compromise
TeamPCP leveraged the Trivy breach to pivot across multiple ecosystems: malicious Docker images (aquasec/trivy:0.69.5, 0.69.6) were pushed to Docker Hub; 28 npm packages under the @EmilGroup scope were infected with CanisterWorm; all 35 Checkmarx KICS GitHub Action tags were hijacked; and two malicious VS Code extensions were published to OpenVSX. The LiteLLM compromise was the final and highest-impact stage.
## LiteLLM Payload Analysis
**Version 1.82.7** (published 10:39 UTC): Modified proxy_server.py to drop a double-base64-encoded payload to disk as p.py, executing when litellm --proxy runs or litellm.proxy.proxy_server is imported.
**Version 1.82.8** (published 10:52 UTC, 13-minute pivot): Used a more sophisticated persistence mechanism via litellm_init.pth (34,628 bytes), a Python path configuration file that executes arbitrary code during interpreter initialization of any Python process. The payload was double-base64 encoded and launched via subprocess, bypassing simple inspection.
## Three-Stage Payload
**Stage 1 — Credential Harvesting**: The payload collected credentials from 50+ categories including: SSH private keys and configs, .env files, AWS/GCP/Azure cloud credentials, Kubernetes configs and service account tokens, Docker configs, database passwords, .gitconfig, shell history, cryptocurrency wallet files, environment variables, CI/CD secrets, and cloud metadata endpoints (IMDS, container credentials).
**Stage 2 — Encrypted Exfiltration**: Collected data was encrypted using AES-256-CBC with a random 32-byte session key generated via OpenSSL. The session key was then encrypted with a hardcoded 4096-bit RSA public key using OAEP padding. The encrypted archive (tpcp.tar.gz) was POSTed to attacker-controlled infrastructure at models.litellm.cloud (version 1.82.8) or checkmarx.zone/raw (version 1.82.7).
**Stage 3 — Kubernetes Lateral Movement & Persistence**: If a Kubernetes service account token was present, the malware read all cluster secrets across all namespaces, created privileged alpine:latest pods (named node-setup-*) on every node in the kube-system namespace with host filesystem mounts, and installed a persistent backdoor at /root/.config/sysmon/sysmon.py on each node. Local persistence was achieved via a systemd user service (sysmon.service) installed at ~/.config/systemd/user/sysmon.service, with the backdoor polling C2 infrastructure for commands.
## Bug in Malware
The .pth mechanism in version 1.82.8 contained an unintentional fork bomb: the .pth file spawned child processes via subprocess.Popen, which re-triggered the same .pth file on startup, causing exponential process creation that crashed some test systems. This accidental behavior may have accelerated detection.
## Impact & Exposure
LiteLLM is a widely-used AI proxy library present in 36% of cloud environments (per Wiz) with approximately 3.4 million daily PyPI downloads. It is a dependency of major AI/ML frameworks including DSPy, MLflow, CrewAI, OpenHan
Weaknesses (CWE)
CWE-506, CWE-494, CWE-502, CWE-829
Target sectors: technology, artificial-intelligence, cloud-services, financial, healthcare, government, defense, education, saas, devops
Target regions: Global
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 52 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
SUPPLY_CHAIN, CRITICAL, threat intelligence, cybersecurity, T1195, T1078, T1059, T1543, T1574, T1611, T1027, T1036, T1552, T1552