LiteLLM Supply Chain Compromise — TeamPCP Multi-Ecosystem Campaign via Trojanized PyPI Packages

LiteLLM Supply Chain Compromise (TL-2026-0290), also tracked as Operation TeamPCP, is a critical-severity supply-chain compromise scored CVSS 9.8, first published 2026-03-26. It is attributed to TeamPCP (Russia) with high confidence, affects BerriAI LiteLLM, maps to 19 MITRE ATT&CK techniques (T1005, T1027, T1036), and is covered by 9 detection rules and 52 indicators of compromise.

Key facts for TL-2026-0290

Threat ID
TL-2026-0290
Also known as
Operation TeamPCP, LiteLLM Backdoor, CanisterWorm Campaign
Severity
CRITICAL
CVSS
9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
Status
MONITORING
Category
SUPPLY_CHAIN
First published
2026-03-26
Last reviewed
2026-03-26
Attribution
TeamPCP
Attribution confidence
HIGH
Nation-state nexus
Russia
Motivation
FINANCIAL
Target sectors
technology, artificial-intelligence, cloud-services, financial, healthcare, government, defense, education, saas, devops
Target regions
Global
Detection rules
9
Indicators of compromise
52

Malware and tooling in LiteLLM Supply Chain Compromise

Malware and tooling: TeamPCP Credential Harvester, CanisterWorm, Cloudflare Tunnels (trycloudflare.com)

TeamPCP compromised LiteLLM versions 1.82.7 and 1.82.8 on PyPI through a cascading supply chain attack originating from a Trivy CI/CD pipeline breach. The three-stage payload harvested credentials from 50+ categories (cloud, SSH, K8s, crypto wallets, LLM API keys), performed Kubernetes lateral movement via privileged pod deployment, and installed persistent backdoors polling attacker C2 infrastructure. With LiteLLM present in 36% of cloud environments and receiving 3.4M daily downloads, the ~3-hour exposure window before PyPI quarantine created significant downstream risk across AI/ML infrastructure.

How LiteLLM Supply Chain Compromise works

On March 24, 2026, threat actor TeamPCP published trojanized versions of LiteLLM (1.82.7 and 1.82.8) to PyPI, marking the culmination of a month-long multi-ecosystem supply chain campaign that previously compromised Aqua Security's Trivy, Checkmarx KICS, npm packages, Docker Hub images, and VS Code extensions.

## Attack Origin — Trivy CI/CD Breach

The campaign began on February 28, 2026, when TeamPCP (operating as 'hackerbot-claw') exploited a misconfigured pull_request_target workflow in Aqua Security's Trivy repository. This allowed them to steal an organization-scoped Personal Access Token (ORG_REPO_TOKEN) belonging to the aqua-bot service account, which had permissions across 33+ workflows. Using this stolen token, TeamPCP force-pushed malicious commits to 75 of 76 trivy-action release tags and all 7 setup-trivy tags on March 19, 2026. The compromised GitHub Actions extracted secrets from runner memory by reading /proc/<pid>/mem on GitHub-hosted runners.

## Cascading Compromise

TeamPCP leveraged the Trivy breach to pivot across multiple ecosystems: malicious Docker images (aquasec/trivy:0.69.5, 0.69.6) were pushed to Docker Hub; 28 npm packages under the @EmilGroup scope were infected with CanisterWorm; all 35 Checkmarx KICS GitHub Action tags were hijacked; and two malicious VS Code extensions were published to OpenVSX. The LiteLLM compromise was the final and highest-impact stage.

## LiteLLM Payload Analysis

**Version 1.82.7** (published 10:39 UTC): Modified proxy_server.py to drop a double-base64-encoded payload to disk as p.py, executing when litellm --proxy runs or litellm.proxy.proxy_server is imported.

**Version 1.82.8** (published 10:52 UTC, 13-minute pivot): Used a more sophisticated persistence mechanism via litellm_init.pth (34,628 bytes), a Python path configuration file that executes arbitrary code during interpreter initialization of any Python process. The payload was double-base64 encoded and launched via subprocess, bypassing simple inspection.

## Three-Stage Payload

**Stage 1 — Credential Harvesting**: The payload collected credentials from 50+ categories including: SSH private keys and configs, .env files, AWS/GCP/Azure cloud credentials, Kubernetes configs and service account tokens, Docker configs, database passwords, .gitconfig, shell history, cryptocurrency wallet files, environment variables, CI/CD secrets, and cloud metadata endpoints (IMDS, container credentials).

**Stage 2 — Encrypted Exfiltration**: Collected data was encrypted using AES-256-CBC with a random 32-byte session key generated via OpenSSL. The session key was then encrypted with a hardcoded 4096-bit RSA public key using OAEP padding. The encrypted archive (tpcp.tar.gz) was POSTed to attacker-controlled infrastructure at models.litellm.cloud (version 1.82.8) or checkmarx.zone/raw (version 1.82.7).

**Stage 3 — Kubernetes Lateral Movement & Persistence**: If a Kubernetes service account token was present, the malware read all cluster secrets across all namespaces, created privileged alpine:latest pods (named node-setup-*) on every node in the kube-system namespace with host filesystem mounts, and installed a persistent backdoor at /root/.config/sysmon/sysmon.py on each node. Local persistence was achieved via a systemd user service (sysmon.service) installed at ~/.config/systemd/user/sysmon.service, with the backdoor polling C2 infrastructure for commands.

## Bug in Malware

The .pth mechanism in version 1.82.8 contained an unintentional fork bomb: the .pth file spawned child processes via subprocess.Popen, which re-triggered the same .pth file on startup, causing exponential process creation that crashed some test systems. This accidental behavior may have accelerated detection.

## Impact & Exposure

LiteLLM is a widely-used AI proxy library present in 36% of cloud environments (per Wiz) with approximately 3.4 million daily PyPI downloads. It is a dependency of major AI/ML frameworks including DSPy, MLflow, CrewAI, OpenHands, and Arize Phoenix. The malicious versions were available for approximately 3 hours (10:39 UTC to ~13:52 UTC on March 24) before PyPI quarantined them. The maintainer's GitHub account appeared compromised, as they closed the critical security issue (#24512) as 'not planned' without acknowledgment, and the account showed 160+ commits created within minutes.

## C2 Infrastructure

TeamPCP operated C2 infrastructure on bulletproof hosting (AS205759) across three IP addresses. They abused Cloudflare Tunnels for fallback exfiltration and used Internet Computer Protocol (ICP) canisters for persistence dropper distribution. The infrastructure included typosquatted domains mimicking legitimate security vendor properties (models.litellm.cloud, checkmarx.zone, scan.aquasecurtiy.org).

MITRE ATT&CK techniques used in TL-2026-0290

collection

T1005 Data from Local System; T1530 Data from Cloud Storage

defense-evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1078 Valid Accounts

exfiltration

T1041 Exfiltration Over C2 Channel

execution

T1059 Command and Scripting Interpreter; T1610 Deploy Container

command-and-control

T1071 Application Layer Protocol; T1090 Proxy; T1573 Encrypted Channel

discovery

T1082 System Information Discovery; T1087 Account Discovery

initial-access

T1195 Supply Chain Compromise

impact

T1496 Resource Hijacking

persistence

T1543 Create or Modify System Process

credential-access

T1552 Unsecured Credentials

stealth

T1574 Hijack Execution Flow

privilege-escalation

T1611 Escape to Host

Affected products and versions in LiteLLM Supply Chain Compromise

  • BerriAI — LiteLLM
    Vulnerable versions: 1.82.7; 1.82.8
    Fixed in: 1.82.9+
  • Aqua Security — trivy-action (GitHub Action)
    Vulnerable versions: 75 of 76 release tags
    Fixed in: v0.35.0 (SHA-pinned)
  • Aqua Security — setup-trivy (GitHub Action)
    Vulnerable versions: All 7 tags except v0.2.6
    Fixed in: v0.2.6
  • Aqua Security — Trivy Docker Image
    Vulnerable versions: 0.69.4; 0.69.5; 0.69.6
    Fixed in: 0.69.3
  • Checkmarx — KICS GitHub Action
    Vulnerable versions: All 35 tags (v1 through v2.1.20)
    Fixed in: Post-incident rebuild
  • @EmilGroup (npm) — 28 npm packages
    Vulnerable versions: CanisterWorm-infected versions
    Fixed in: Removed from npm
  • OpenVSX — 2 VS Code extensions
    Vulnerable versions: Malicious versions
    Fixed in: Removed from marketplace

Remediation for LiteLLM Supply Chain Compromise

Patches

  • Upgrade to LiteLLM >= 1.82.9 (clean release)
  • Pin trivy-action to SHA @57a97c7e7821a5776cebc9bb87c984fa69cba8f1 (v0.35.0)
  • Pin setup-trivy to v0.2.6 (unaffected tag)
  • Use Trivy binary v0.69.3 or later clean release

Immediate actions

  • Remove LiteLLM 1.82.7 and 1.82.8 from all environments immediately
  • Purge package manager caches (pip cache purge, rm -rf ~/.cache/uv)
  • Search for litellm_init.pth in all package caches and site-packages
  • Audit ~/.config/sysmon/ for backdoor files (sysmon.py)
  • Check for systemd user service at ~/.config/systemd/user/sysmon.service
  • Search Kubernetes clusters for unauthorized node-setup-* pods in kube-system namespace
  • Block C2 IPs at perimeter: 83.142.209.11, 46.151.182.203, 45.148.10.212
  • Block domains: models.litellm.cloud, checkmarx.zone, scan.aquasecurtiy.org

Workarounds

  • Temporarily pin LiteLLM to 1.82.6 or earlier known-clean version
  • Use --require-hashes with pip to verify package integrity
  • Run pip show litellm to verify installed version before any usage
  • Use find ~/.cache/uv -name litellm_init.pth to detect cached compromised packages

Longer-term hardening

  • Rotate ALL credentials on any system where compromised versions were installed
  • Audit Kubernetes RBAC to restrict secret read access and pod creation in kube-system
  • Pin all GitHub Actions to commit SHAs instead of version tags
  • Implement package integrity verification and SLSA provenance checks
  • Deploy EDR with behavioral detection for .pth file abuse and credential harvesting
  • Monitor outbound traffic from CI/CD runners to detect exfiltration
  • Enforce GPG-signed commits on release branches

Weaknesses (CWE) in LiteLLM Supply Chain Compromise

CWE-506, CWE-494, CWE-502, CWE-829

Timeline of LiteLLM Supply Chain Compromise

  • TeamPCP begins tooling development; pcpcat.py v1 credential harvester first observed
  • TeamPCP provisions C2 infrastructure: registers typosquat domains (models.litellm.cloud, checkmarx.zone, scan.aquasecurtiy.org), sets up bulletproof hosting on AS205759
  • hackerbot-claw exploits misconfigured pull_request_target workflow in Trivy repository, exfiltrates organization-scoped ORG_REPO_TOKEN belonging to aqua-bot service account
  • Aqua Security discloses first Trivy CI incident, begins credential rotation across 33+ workflows
  • TeamPCP force-pushes malicious commits to 75 of 76 trivy-action release tags and all 7 setup-trivy tags; compromised Actions extract secrets from runner memory via /proc/pid/mem
  • CanisterWorm deployed to npm ecosystem; 28 packages in @EmilGroup scope infected with malicious payloads
  • Malicious Docker images pushed to Docker Hub as aquasec/trivy:0.69.5 and 0.69.6 with embedded credential harvesting payloads
  • All 35 Checkmarx KICS GitHub Action tags hijacked (v1 through v2.1.20); 2 malicious VS Code extensions published to OpenVSX marketplace
  • PyPI yanks both compromised versions at approximately 13:52 UTC, ending ~3-hour exposure window affecting an estimated 3.4M daily downloads
  • Compromised maintainer account closes critical security issue as not planned at 12:49 UTC; account shows 160+ commits created within minutes indicating account compromise
  • GitHub issue #24512 opened at 12:07 UTC by Rui Hu (@isfinne) reporting malicious litellm_init.pth; team member warns thousands of people are likely getting pwned
  • LiteLLM 1.82.8 published to PyPI at 10:52 UTC (13-minute pivot) with litellm_init.pth persistence mechanism exfiltrating to models.litellm.cloud
  • LiteLLM 1.82.7 published to PyPI at 10:39 UTC with malicious proxy_server.py containing double-base64-encoded payload exfiltrating to checkmarx.zone/raw
  • Wiz publishes analysis confirming LiteLLM present in 36% of cloud environments; links campaign to prior TeamPCP operations against Trivy and KICS
  • Trend Micro publishes comprehensive technical analysis of the full three-stage payload, complete kill chain, and multi-ecosystem campaign scope
  • As of 2026-05-29, the specific LiteLLM packages (1.82.7/1.82.8) were PyPI-quarantined within ~3 hours and fixed in 1.82.9+, but actor TeamPCP (UNC6780) remains highly active with 7+ supply-chain waves through May, a 3,800-repo GitHub breach, and a May open-sourcing of its worm that is already spawning copycats.

Sources cited for LiteLLM Supply Chain Compromise

Threats related to LiteLLM Supply Chain Compromise

Detection coverage for TL-2026-0290

As of 2026-03-26, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0290 across Splunk SPL, Microsoft KQL and Sigma, covering 52 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Further reading

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats