Threat Research · securitylabs.datadoghq.com

Datadog Traces TeamPCP Supply-Chain Campaign to Compromised LiteLLM PyPI Releases

Mar 25, 2026 · Original article ↗

Summary

Datadog researchers trace compromised LiteLLM PyPI releases 1.82.7 and 1.82.8 to TeamPCP’s wider supply-chain campaign. The payload harvested credentials, established persistence and could spread into Kubernetes; responders are urged to rotate exposed credentials and be

Key points

Datadog traces a five-day campaign from a malicious Trivy release on March 19 through npm and Checkmarx to compromised LiteLLM releases published on March 24, 2026.
LiteLLM 1.82.7 contained injected code in proxy_server.py that executes when the module is imported; 1.82.8 added a .pth startup hook that executes when Python starts.
The payload collected credentials and secrets, encrypted them with AES-256 and RSA-4096, and exfiltrated the resulting data.
The malware installed a user systemd service for persistence and polled for follow-on payloads.
With an accessible Kubernetes service-account token, the LiteLLM payload could create privileged node-setup-* pods; related campaign activity included destructive and backdoor paths for Kubernetes targets.
Datadog recommends scoping affected hosts and CI jobs, rotating credentials reachable from them, hunting for persistence and follow-on activity, and rebuilding critical systems from known-good images.

Article Details

Attack Vectors: Compromised credentials were used to publish malicious releases and alter GitHub repository tags, actions, and workflows across multiple projects.
Malicious code was distributed through compromised PyPI, npm, GitHub Actions, and OpenVSX artifacts.
LiteLLM 1.82.7 contained an injected payload in proxy_server.py; LiteLLM 1.82.8 used a .pth file that executed at Python interpreter startup.
Payloads harvested environment variables, SSH keys, cloud credentials, Kubernetes data, Docker configuration, and CI/CD secrets, then encrypted and exfiltrated the data.
The LiteLLM payload installed a user systemd service and polled for follow-on payloads.
With accessible Kubernetes credentials, the campaign could create privileged pods; related campaign activity used a destructive container against systems identified as Iranian.
Defensive Notes: Treat systems, CI jobs, containers, and workstations that installed LiteLLM 1.82.7 or 1.82.8 as potentially compromised and assess whether the payload executed.
Revoke and rotate credentials reachable from affected environments, prioritizing code-publishing, CI/CD, cloud, SSH, and Kubernetes credentials.
Hunt for the listed C2 and exfiltration infrastructure, persistence files and service, downloaded payload artifacts, unusual secret access, and privileged Kubernetes pod activity.
Remove compromised versions, review artifacts published from exposed environments, and rebuild critical systems from known-good images with pinned dependencies.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`aquasecurtiy[.]org`	Typosquatted domain identified as part of the earlier Trivy compromise campaign.
DOMAIN	`checkmarx[.]zone`	Attacker-controlled domain used for follow-on C2 polling, including the path /raw.
DOMAIN	`models[.]litellm[.]cloud`	Attacker-controlled endpoint used to exfiltrate encrypted data collected by the LiteLLM payload.
HOSTNAME	`championships-peoples-point-cassette[.]trycloudflare[.]com`	Cloudflare tunnel hostname identified as related campaign infrastructure.
HOSTNAME	`investigation-launches-hearings-copying[.]trycloudflare[.]com`	Cloudflare tunnel hostname identified as related campaign infrastructure.
HOSTNAME	`scan[.]aquasecurtiy[.]org`	Look-alike domain used to exfiltrate data stolen during the Trivy compromise.
HOSTNAME	`souls-entire-defined-routes[.]trycloudflare[.]com`	Cloudflare tunnel hostname identified as related campaign infrastructure.
HOSTNAME	`tdtqy-oyaaa-aaaae-af2dq-cai[.]raw[.]icp0[.]io`	CanisterWorm C2 infrastructure associated with the related campaign.