Skip to content
OriginalSign in

StepSecurity

litellm: Credential Stealer Hidden in PyPI Wheel

Part of the litellm story · since 24 Mar

Quiet for 30 weekslast report 6 Apr15 articles9 outlets
24 Mar · StepSecurity first14 Jul21 Aug28 SepNowThis article1st of 15
  • Tue 24 Mar, 14:20 UTC. StepSecurity, first report. litellm: Credential Stealer Hidden in PyPI Wheel. This article, 1st of 15.
  • Tue 24 Mar, 19:57 UTC. The Hacker News, its first report on the story. TeamPCP Backdoors LiteLLM Versions 1.82.7–1.82.8 Likely via Trivy CI/CD Compromise.
  • Tue 24 Mar, 21:58 UTC. Dark Reading, its first report on the story. Checkmarx KICS Code Scanner Targeted in Widening Supply Chain Hit.
  • Wed 25 Mar, 10:13 UTC. Security Affairs, its first report on the story. Malicious LiteLLM versions linked to TeamPCP supply chain attack.
  • Wed 25 Mar, 12:14 UTC. Infosecurity, its first report on the story. TeamPCP Expands Supply Chain Campaign With LiteLLM PyPI Compromise.
  • Wed 25 Mar, 12:44 UTC. DataBreaches, its first report on the story. TeamPCP Hits Trivy, Checkmarx, and LiteLLM in Credential Theft Campaign.
  • Thu 26 Mar, 11:06 UTC. Securelist, its first report on the story. An AI gateway designed to steal your data.
  • Thu 26 Mar, 17:43 UTC. SANS ISC, its first report on the story. TeamPCP Supply Chain Campaign: Update 001 ? Checkmarx Scope Wider Than Reported, CISA KEV Entry, and Detection Tools Available, (Thu, Mar 26th). Cites a CVE in CISA KEV.
  • Fri 27 Mar, 15:32 UTC. SANS ISC. TeamPCP Supply Chain Campaign: Update 002 - Telnyx PyPI Compromise, Vect Ransomware Mass Affiliate Program, and First Named Victim Claim, (Fri, Mar 27th).
  • Fri 27 Mar, 17:42 UTC. The Hacker News. TeamPCP Pushes Malicious Telnyx Versions to PyPI, Hides Stealer in WAV Files.
  • Mon 30 Mar, 11:08 UTC. SecurityWeek, its first report on the story. Telnyx Targeted in Growing TeamPCP Supply Chain Attack.
  • Wed 1 Apr, 10:04 UTC. Security Affairs. SentinelOne autonomous detection blocks trojaned LiteLLM triggered by Claude Code.
  • Wed 1 Apr, 14:20 UTC. SANS ISC. TeamPCP Supply Chain Campaign: Update 005 - First Confirmed Victim Disclosure, Post-Compromise Cloud Enumeration Documented, and Axios Attribution Narrows, (Wed, Apr 1st).
  • Thu 2 Apr, 10:45 UTC. SecurityWeek. Mercor Hit by LiteLLM Supply Chain Attack.
  • Mon 6 Apr, 13:08 UTC. The Hacker News. LiteLLM supply chain attack steals developer credentials globally.

On 24 March 2026, StepSecurity reported a critical supply chain compromise in litellm==1.82.8: the PyPI package contains a malicious litellm_init.pth file that auto-executes a multi-stage credential stealer every time the Python interpreter starts, an issue disclosed in BerriAI/litellm#24512. The payload includes a 34,628‑byte litellm_init.pth listed in the package’s RECORD with a SHA-256 hash, indicating it was injected at publish time rather than through post-publish tampering.

The attack unfolds in three stages: a mass credential harvester that exfiltrates secrets via AES-256/RSA-4096 encrypted payloads to a C2 at models.litellm[.]cloud, a parallel persistence backdoor named sysmon.py registered as a systemd user service, and Kubernetes lateral movement that can deploy a privileged pod to every node to install the backdoor on the host OS.

Remediation calls for rotating all credentials, checking for the malicious .pth file and persistence backdoor, auditing Kubernetes clusters, and upgrading litellm to a clean version. Actions in CI/CD pipelines should assume secrets were exfiltrated and rotated accordingly.

How the story developed

All 15 articles
Quiet for 30 weekslast report 6 Apr15 articles9 outlets

15 articles from 9 outlets since 24 Mar. Quiet since 6 Apr. This was the first report.

Now24 Mar2628302468First reportStepSecurity · 24 Mar, 14:20Exploited CVESANS ISC · 26 Mar
  • Tue 24 Mar, 14:20 UTC. StepSecurity, first report. litellm: Credential Stealer Hidden in PyPI Wheel. This article, 1st of 15.
  • Tue 24 Mar, 19:57 UTC. The Hacker News, its first report on the story. TeamPCP Backdoors LiteLLM Versions 1.82.7–1.82.8 Likely via Trivy CI/CD Compromise.
  • Tue 24 Mar, 21:58 UTC. Dark Reading, its first report on the story. Checkmarx KICS Code Scanner Targeted in Widening Supply Chain Hit.
  • Wed 25 Mar, 10:13 UTC. Security Affairs, its first report on the story. Malicious LiteLLM versions linked to TeamPCP supply chain attack.
  • Wed 25 Mar, 12:14 UTC. Infosecurity, its first report on the story. TeamPCP Expands Supply Chain Campaign With LiteLLM PyPI Compromise.
  • Wed 25 Mar, 12:44 UTC. DataBreaches, its first report on the story. TeamPCP Hits Trivy, Checkmarx, and LiteLLM in Credential Theft Campaign.
  • Thu 26 Mar, 11:06 UTC. Securelist, its first report on the story. An AI gateway designed to steal your data.
  • Thu 26 Mar, 17:43 UTC. SANS ISC, its first report on the story. TeamPCP Supply Chain Campaign: Update 001 ? Checkmarx Scope Wider Than Reported, CISA KEV Entry, and Detection Tools Available, (Thu, Mar 26th). Cites a CVE in CISA KEV.
  • Fri 27 Mar, 15:32 UTC. SANS ISC. TeamPCP Supply Chain Campaign: Update 002 - Telnyx PyPI Compromise, Vect Ransomware Mass Affiliate Program, and First Named Victim Claim, (Fri, Mar 27th).
  • Fri 27 Mar, 17:42 UTC. The Hacker News. TeamPCP Pushes Malicious Telnyx Versions to PyPI, Hides Stealer in WAV Files.
  • Mon 30 Mar, 11:08 UTC. SecurityWeek, its first report on the story. Telnyx Targeted in Growing TeamPCP Supply Chain Attack.
  • Wed 1 Apr, 10:04 UTC. Security Affairs. SentinelOne autonomous detection blocks trojaned LiteLLM triggered by Claude Code.
  • Wed 1 Apr, 14:20 UTC. SANS ISC. TeamPCP Supply Chain Campaign: Update 005 - First Confirmed Victim Disclosure, Post-Compromise Cloud Enumeration Documented, and Axios Attribution Narrows, (Wed, Apr 1st).
  • Thu 2 Apr, 10:45 UTC. SecurityWeek. Mercor Hit by LiteLLM Supply Chain Attack.
  • Mon 6 Apr, 13:08 UTC. The Hacker News. LiteLLM supply chain attack steals developer credentials globally.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
  • Quiet time, folded
Show all 15 articles as a list
  1. Tue 24 MarDay 03
    1. litellm: Credential Stealer Hidden in PyPI Wheel14:20 · StepSecurity · First report · This article, 1st of 15
    2. TeamPCP Backdoors LiteLLM Versions 1.82.7–1.82.8 Likely via Trivy CI/CD Compromise19:57 · The Hacker News
    3. Checkmarx KICS Code Scanner Targeted in Widening Supply Chain Hit21:58 · Dark Reading
  2. Wed 25 MarDay 13
    1. Malicious LiteLLM versions linked to TeamPCP supply chain attack10:13 · Security Affairs
    2. TeamPCP Expands Supply Chain Campaign With LiteLLM PyPI Compromise12:14 · Infosecurity
    3. TeamPCP Hits Trivy, Checkmarx, and LiteLLM in Credential Theft Campaign12:44 · DataBreaches
  3. Thu 26 MarDay 22
    1. An AI gateway designed to steal your data11:06 · Securelist
    2. TeamPCP Supply Chain Campaign: Update 001 ? Checkmarx Scope Wider Than Reported, CISA KEV Entry, and Detection Tools Available, (Thu, Mar 26th)17:43 · SANS ISC · Exploited CVE · Known exploited CVE
  4. Fri 27 MarDay 32
    1. TeamPCP Supply Chain Campaign: Update 002 - Telnyx PyPI Compromise, Vect Ransomware Mass Affiliate Program, and First Named Victim Claim, (Fri, Mar 27th)15:32 · SANS ISC
    2. TeamPCP Pushes Malicious Telnyx Versions to PyPI, Hides Stealer in WAV Files17:42 · The Hacker News

  5. Quiet for 3 days

    Mon 30 MarDay 61
    1. Telnyx Targeted in Growing TeamPCP Supply Chain Attack11:08 · SecurityWeek · Picked up again

  6. Quiet for 2 days

    Wed 1 AprDay 82
    1. SentinelOne autonomous detection blocks trojaned LiteLLM triggered by Claude Code10:04 · Security Affairs
    2. TeamPCP Supply Chain Campaign: Update 005 - First Confirmed Victim Disclosure, Post-Compromise Cloud Enumeration Documented, and Axios Attribution Narrows, (Wed, Apr 1st)14:20 · SANS ISC
  7. Thu 2 AprDay 91
    1. Mercor Hit by LiteLLM Supply Chain Attack10:45 · SecurityWeek

  8. Quiet for 4 days

    Mon 6 AprDay 131
    1. LiteLLM supply chain attack steals developer credentials globally13:08 · The Hacker News · Picked up again

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in