TeamPCP Supply‑Chain Attack Backdoors LiteLLM Python Package

Du'aine Davis

Observed in the wild

• On 24 March, Endor Labs identified malicious code in LiteLLM versions 1.82.7 and 1.82.8 published to PyPI. LiteLLM is a widely used LLM proxy library with around 95 million monthly downloads. Any environment installing these versions, including CI/CD pipelines and Kubernetes clusters, was at risk of full credential compromise. Both versions were removed; 1.82.6 is the last confirmed clean release.
• The attack is attributed with high confidence to TeamPCP, a supply‑chain threat actor. Malicious code was injected during package build, not in GitHub source. The payload executed on import and, in 1.82.8, on every Python start via a .pth file. The malware harvested cloud, Kubernetes and developer credentials, deployed privileged Kubernetes pods for lateral movement, and installed a persistent systemd backdoor communicating with attacker‑controlled infrastructure.
• Organisations are advised to identify and remove LiteLLM 1.82.7 and 1.82.8, rotate all secrets accessible on affected hosts, and treat impacted systems as compromised. Use Microsoft Defender for Cloud to hunt for anomalous Python subprocess execution, credential access, and unexpected Kubernetes privileged pods. Monitor for outbound traffic to known C2 domains and persistence indicators, and pin Python dependencies to verified source builds only.

TeamPCP Isn't Done: Threat Actor Behind Trivy and KICS Compromises Now Hits LiteLLM's 95 Million Monthly Downloads on PyPI | Blog | Endor Labs

Du'aine Davis

TeamPCP Multi‑Ecosystem Supply Chain Compromise Developments and Timeline
Observed in the wild

• Between 27 February and late March, the TeamPCP campaign evolved from an initial compromise of Aqua Trivy’s CI into a rapidly expanding supply‑chain incident. By 23–27 March, malicious releases and images affected Checkmarx tools, LiteLLM, npm and PyPI packages, and Docker Hub images, exposing a wide range of downstream enterprise and developer environments. Based on the most recent timeline evidence, the TeamPCP campaign should still be treated as active.
• The attacker moved in phases: initial CI compromise, lateral movement via bot and service accounts, and mass distribution through trusted registries. Recent developments include self‑propagating npm worms, Docker Hub direct image pushes bypassing GitHub releases, and WAV‑embedded payloads on PyPI. The coordinated timeline, shared C2 infrastructure, and rapid iteration underpin attribution to the TeamPCP threat cluster.
• Organisations are advised to prioritise reviewing March 2026 releases of affected tools and rotate all CI/CD secrets immediately. In Microsoft Defender, focus on abnormal GitHub Actions behaviour, unexpected script execution during builds, unsigned container image pulls, and package install‑time execution. Recent activity highlights the need for strict token scoping, enforced MFA for maintainers, and continuous monitoring of build and registry activity.

Incident Timeline // TeamPCP Supply Chain Campaign