Executive Summary
In March 2026, the LiteLLM Python package, a widely used library with over 95 million downloads in the past month, was compromised in a supply chain attack attributed to the TeamPCP hacking group. Malicious versions 1.82.7 and 1.82.8 were uploaded to the Python Package Index (PyPI), embedding an infostealer that harvested sensitive data, including SSH keys, cloud credentials, and Kubernetes secrets, from approximately 500,000 devices. The attack involved injecting base64-encoded payloads into the package, which, upon execution, deployed the 'TeamPCP Cloud Stealer' and established persistence mechanisms to exfiltrate data to attacker-controlled domains.
This incident underscores the escalating threat of supply chain attacks targeting open-source ecosystems. The compromise of LiteLLM follows previous breaches by TeamPCP, including the Trivy vulnerability scanner and Checkmarx's KICS project, highlighting a pattern of targeting widely adopted development tools to maximize impact. Organizations are urged to implement stringent security measures, such as regular dependency audits, multi-factor authentication for package maintainers, and prompt rotation of exposed credentials, to mitigate the risks associated with such attacks.
Why This Matters Now
The LiteLLM supply chain attack highlights the increasing sophistication and frequency of threats targeting open-source software repositories. As organizations increasingly rely on these packages, the potential for widespread compromise grows, emphasizing the urgent need for enhanced security practices and vigilance in software supply chains.
Attack Path Analysis
The TeamPCP hacking group compromised the LiteLLM Python package on PyPI, embedding malicious code that, upon installation, executed an infostealer to harvest sensitive data. The malware escalated privileges by deploying a systemd backdoor disguised as a 'System Telemetry Service,' enabling persistent access. It then attempted lateral movement by deploying privileged pods across Kubernetes clusters to access additional nodes. The compromised systems established command and control by communicating with attacker-controlled domains to exfiltrate data. Exfiltrated data, including SSH keys, cloud tokens, and Kubernetes secrets, was encrypted and sent to the attackers. The impact was significant, with data from approximately 500,000 devices compromised, leading to potential unauthorized access and data breaches.
Kill Chain Progression
Initial Compromise
Description
The TeamPCP hacking group compromised the LiteLLM Python package on PyPI, embedding malicious code that, upon installation, executed an infostealer to harvest sensitive data.
MITRE ATT&CK® Techniques
Compromise Software Supply Chain
Command and Scripting Interpreter: PowerShell
Command and Scripting Interpreter: Windows Command Shell
Application Layer Protocol: Web Protocols
Data from Local System
Archive Collected Data: Archive via Utility
Exfiltration Over C2 Channel
Create or Modify System Process: Windows Service
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Ensure all system components and software are protected from known vulnerabilities
Control ID: 6.2
NYDFS 23 NYCRR 500 – Cybersecurity Policy
Control ID: 500.03
DORA – ICT Risk Management Framework
Control ID: Article 6
CISA ZTMM 2.0 – Implement supply chain risk management practices
Control ID: Supply Chain Risk Management
NIS2 Directive – Cybersecurity Risk Management Measures
Control ID: Article 21
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Computer Software/Engineering
LiteLLM PyPI package compromise directly impacts software development environments, exposing SSH keys, cloud credentials, and CI/CD secrets through supply chain attack vectors.
Information Technology/IT
TeamPCP's credential harvesting targets IT infrastructure including Kubernetes clusters, AWS/GCP/Azure tokens, and systemd persistence mechanisms across cloud environments.
Financial Services
Cryptocurrency wallet theft and authentication token compromise pose significant risks to financial institutions using affected Python packages in trading systems.
Computer/Network Security
Security teams face cascading breaches from compromised vulnerability scanners and security tools, requiring immediate credential rotation and cluster inspection protocols.
Sources
- Popular LiteLLM PyPI package backdoored to steal credentials, auth tokenshttps://www.bleepingcomputer.com/news/security/popular-litellm-pypi-package-compromised-in-teampcp-supply-chain-attack/Verified
- LiteLLM · PyPIhttps://pypi.org/project/litellm/Verified
- LiteLLM Vulnerable to Remote Code Execution (RCE)https://advisories.gitlab.com/pkg/pypi/litellm/CVE-2024-6825/Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Aviatrix Zero Trust CNSF is pertinent to this incident as it embeds security directly within the cloud fabric, potentially limiting the attacker's ability to move laterally and exfiltrate data.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: The embedded security controls within the cloud fabric could have limited the execution of unauthorized code, potentially reducing the initial compromise's effectiveness.
Control: Zero Trust Segmentation
Mitigation: Zero Trust Segmentation could have restricted unauthorized services from gaining elevated privileges, potentially limiting the attacker's ability to establish persistent access.
Control: East-West Traffic Security
Mitigation: East-West Traffic Security could have limited unauthorized inter-service communications, potentially reducing the attacker's ability to move laterally across Kubernetes clusters.
Control: Multicloud Visibility & Control
Mitigation: Enhanced visibility and control across multicloud environments could have identified and limited unauthorized outbound communications, potentially disrupting command and control channels.
Control: Egress Security & Policy Enforcement
Mitigation: Egress Security & Policy Enforcement could have restricted unauthorized data transfers, potentially limiting the exfiltration of sensitive information.
The implementation of Aviatrix Zero Trust CNSF could have reduced the overall impact by limiting the attacker's ability to move laterally and exfiltrate data, thereby potentially decreasing the number of compromised devices.
Impact at a Glance
Affected Business Functions
- Software Development
- Data Science
- Machine Learning Operations
Estimated downtime: 7 days
Estimated loss: $500,000
Potential exposure of sensitive credentials, including SSH keys, cloud service tokens, Kubernetes secrets, and cryptocurrency wallets.
Recommended Actions
Key Takeaways & Next Steps
- • Implement supply chain management programs to assess the trustworthiness of software dependencies and validate their integrity.
- • Utilize code signing and integrity checks to verify the authenticity of software packages before deployment.
- • Deploy intrusion prevention systems (IPS) to detect and block known exploit patterns and malicious payloads.
- • Enforce zero trust segmentation to limit lateral movement within Kubernetes clusters and other critical systems.
- • Establish robust monitoring and anomaly detection mechanisms to identify and respond to unauthorized access and data exfiltration attempts.
