# TeamPCP LiteLLM Supply Chain Attack — Trojaned PyPI Packages (v1.82.7/1.82.8) with Multi-Stage C2 Payload

> Threat actor TeamPCP compromised the LiteLLM PyPI package by publishing trojaned versions 1.82.7 and 1.82.8 on March 24, 2026. The attack originated from a cascading supply chain compromise that began with Aqua Security's Trivy scanner on March 19, expanded to Checkmarx KICS/AST on March 23, and culminated in credential theft of the LiteLLM maintainer's PyPI token. The malicious payload deploys a multi-stage credential stealer with systemd persistence and encrypted C2 communication to models.litellm.cloud, targeting cloud credentials, SSH keys, crypto wallets, and Kubernetes secrets.

- **Published:** 2026-03-31T12:00:00Z
- **Last reviewed:** 2026-09-13T14:34:55.731Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0304
- **ID:** TL-2026-0304
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Actor:** TeamPCP
- **Detections:** 9 · **IOCs:** 134 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-33634, CVE-2025-55182, CVE-2026-45321, CVE-2023-48022, CVE-2025-29927, CVE-2026-48027, CVE-2026-26189

## Description

TeamPCP executed a sophisticated cascading supply chain attack that weaponized trusted security tooling to compromise downstream software packages. The campaign began in February 2026 with an initial credential compromise in Aqua Security's repository, enabling the threat actor to poison Trivy—a widely-deployed open-source vulnerability scanner—on March 19, 2026. The attackers modified 76 of 77 version tags for the Trivy GitHub Actions (aquasecurity/setup-trivy versions 0.2.0–0.2.6), injecting credential-harvesting payloads that extracted CI/CD secrets from GitHub Actions runner environments, including cloud access tokens, SSH keys, and package registry credentials.

On March 21–23, TeamPCP leveraged stolen CI/CD secrets to compromise Checkmarx's GitHub Actions for infrastructure-as-code security scanning (kics-github-action v1.1, ast-github-action v2.3.28) and VS Code extensions (checkmarx.ast-results v2.53, checkmarx.cx-dev-assist v1.7.0), affecting 35 version tags. The Checkmarx wave used checkmarx.zone as its C2 domain.

The LiteLLM compromise on March 24, 2026 was the direct downstream consequence: the attackers used a stolen PyPI publishing token (PYPI_PUBLISH) exfiltrated from LiteLLM's CI/CD pipeline via the poisoned Trivy action. They bypassed the official GitHub CI/CD entirely, uploading malicious packages directly to PyPI. Version 1.82.7 was uploaded at 10:39:24 UTC and version 1.82.8 at 10:52:19 UTC.

The payload architecture differed between versions. In v1.82.7, a base64-encoded Python payload was injected into litellm/proxy/proxy_server.py, executing whenever the litellm.proxy module was imported. Version 1.82.8 escalated the attack surface by adding litellm_init.pth (34,628 bytes)—a Python path configuration file that executes automatically on every Python interpreter startup when litellm is installed, removing the requirement for explicit LiteLLM usage.

The first-stage payload consists of a single line of base64-decoded Python launched in a detached subprocess with stdout/stderr suppressed: import base64; exec(base64.b64decode(...)). The second stage downloads a follow-on payload to /tmp/pglog and establishes persistence via a systemd user service at ~/.config/systemd/user/sysmon.service with the main script at ~/.config/sysmon/sysmon.py. The service name 'sysmon' was deliberately chosen to mimic legitimate system monitoring tools.

The persistence mechanism implements a 5-minute delay before initial network activity, then beacons to the C2 server every 50 minutes. The C2 communication uses a hybrid RSA-4096 + AES-256-CBC encryption scheme with a hardcoded public key—the same RSA key was reused across multiple campaign payloads, providing a strong attribution link.

The credential stealer component aggressively harvests: SSH private keys (~/.ssh/), AWS credentials (~/.aws/credentials, AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY env vars), GCP Application Default Credentials, Azure tokens, Kubernetes configs (~/.kube/config), database passwords, .env files containing API keys, shell history, SSL/TLS private keys, CI/CD configuration files, and cryptocurrency wallet data. It also performs Instance Metadata Service (IMDS) exploitation and process memory extraction via /proc/<pid>/mem to bypass GitHub secret masking.

Collected data is compressed into tpcp.tar.gz and exfiltrated via HTTP POST to https://models.litellm.cloud/ with the header X-Filename: tpcp.tar.gz. The archive is encrypted with AES-256-CBC using a random session key, which is then wrapped with the RSA-4096 public key.

In Kubernetes environments, the malware deploys privileged DaemonSets: host-provisioner-iran (container: kamikaze) for destructive operations and host-provisioner-std for persistent backdoor access, both in the kube-system namespace using alpine:latest with hostPID, hostNetwork, and privileged security context.

The campaign expanded to Telnyx Python SDK on March 27, compromising versions 4.87.1 and 4.87.2 with a novel payload delivery mechanism using WAV file steganography—a crafted ringtone.wav downloaded from 83.142.209.203:8080 containing XOR-encrypted data with 8-byte keys embedded in 16-byte audio frames.

SentinelOne's AI EDR autonomously detected and blocked the attack within 44 seconds across 424 behavioral events, identifying the malicious pattern without a signature for the specific package. An AI coding assistant (Anthropic's Claude) running with unrestricted system permissions autonomously updated LiteLLM to the trojaned version without human review, highlighting the risk of AI-driven dependency management.

The malicious packages were available for approximately 5 hours and 21 minutes before PyPI quarantined the package. The Trivy compromise carries CVE-2026-33634 (CVSS 9.4). TeamPCP has claimed exfiltration of 300GB+ data and 500,000 credentials from infected endpoints.

## MITRE ATT&CK

- T1195 Supply Chain Compromise
- T1199 Trusted Relationship
- T1078 Valid Accounts
- T1059 Command and Scripting Interpreter
- T1543 Create or Modify System Process
- T1547 Boot or Logon Autostart Execution
- T1574 Hijack Execution Flow
- T1140 Deobfuscate/Decode Files or Information
- T1036 Masquerading
- T1027 Obfuscated Files or Information
- T1070 Indicator Removal
- T1552 Unsecured Credentials
- T1528 Steal Application Access Token
- T1555 Credentials from Password Stores
- T1087 Account Discovery
- T1082 System Information Discovery
- T1074 Data Staged
- T1005 Data from Local System
- T1071 Application Layer Protocol
- T1573 Encrypted Channel
- T1105 Ingress Tool Transfer
- T1572 Protocol Tunneling
- T1041 Exfiltration Over C2 Channel
- T1567 Exfiltration Over Web Service
- T1485 Data Destruction
- T1570 Lateral Tool Transfer
- T1583 Acquire Infrastructure
- T1585 Establish Accounts
- T1588 Obtain Capabilities
- T1204 User Execution
- T1546 Event Triggered Execution
- T1098 Account Manipulation
- T1083 File and Directory Discovery
- T1526 Cloud Service Discovery
- T1613 Container and Resource Discovery
- T1080 Taint Shared Content
- T1102 Web Service
- T1090 Proxy
- T1020 Automated Exfiltration
- T1486 Data Encrypted for Impact

## Sources

- [SentinelOne: AI EDR Discovers and Stops Zero-Day Supply Chain Attack](https://www.sentinelone.com/blog/how-sentinelones-ai-edr-autonomously-discovered-and-stopped-anthropics-claude-from-executing-a-zero-day-supply-chain-attack-globally/)
- [Datadog Security Labs: LiteLLM and Telnyx Compromised on PyPI](https://securitylabs.datadoghq.com/articles/litellm-compromised-pypi-teampcp-supply-chain-campaign/)
- [Unit 42: Weaponizing the Protectors — TeamPCP Multi-Stage Supply Chain Attack](https://unit42.paloaltonetworks.com/teampcp-supply-chain-attacks/)
- [ReversingLabs: Inside the TeamPCP Cascading Supply Chain Attack](https://www.reversinglabs.com/blog/teampcp-supply-chain-attack-spreads)
- [LiteLLM Official Security Update: March 2026](https://docs.litellm.ai/blog/security-update-march-2026)
- [Wiz Blog: TeamPCP Trojanizes LiteLLM](https://www.wiz.io/blog/threes-a-crowd-teampcp-trojanizes-litellm-in-continuation-of-campaign)
- [Kaspersky: Supply Chain Attack via Trivy and LiteLLM](https://www.kaspersky.com/blog/critical-supply-chain-attack-trivy-litellm-checkmarx-teampcp/55510/)
- [Microsoft Security: Detecting and Defending Against Trivy Supply Chain Compromise](https://www.microsoft.com/en-us/security/blog/2026/03/24/detecting-investigating-defending-against-trivy-supply-chain-compromise/)
- [Endor Labs: TeamPCP Hits LiteLLM's 95 Million Monthly Downloads](https://www.endorlabs.com/learn/teampcp-isnt-done)
- [Snyk: How a Poisoned Security Scanner Became the Key to Backdooring LiteLLM](https://snyk.io/articles/poisoned-security-scanner-backdooring-litellm/)
- [Sonatype: Compromised litellm PyPI Package Delivers Multi-Stage Credential Stealer](https://www.sonatype.com/blog/compromised-litellm-pypi-package-delivers-multi-stage-credential-stealer)
- [Sysdig: TeamPCP Expands Supply Chain Compromise](https://www.sysdig.com/blog/teampcp-expands-supply-chain-compromise-spreads-from-trivy-to-checkmarx-github-actions)
- [SANS Institute: When the Security Scanner Became the Weapon](https://www.sans.org/blog/when-security-scanner-became-weapon-inside-teampcp-supply-chain-campaign)
- [Arctic Wolf: TeamPCP Supply Chain Attack Campaign](https://arcticwolf.com/resources/blog/teampcp-supply-chain-attack-campaign-targets-trivy-checkmarx-kics-and-litellm-potential-downstream-impact-to-additional-projects/)
- [GitGuardian: Trivy Supply Chain Attack and Secret Exposure](https://blog.gitguardian.com/trivys-march-supply-chain-attack-shows-where-secret-exposure-hurts-most/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0304