TeamPCP-Linked Backdoors Found in LiteLLM PyPI Versions 1.82.7 and 1.82.8
Summary
LiteLLM versions 1.82.7 and 1.82.8 contained malware that harvested credentials, spread through Kubernetes clusters and installed a systemd backdoor. Researchers said the compromise likely involved Trivy CI/CD; both versions were removed from PyPI.
Key points
- The malicious LiteLLM versions 1.82.7 and 1.82.8 were published to PyPI on March 24, 2026, and were later removed. Researchers said the compromise likely stemmed from Trivy use in the package's CI/CD workflow.
- Version 1.82.7 triggers the payload when litellm.proxy.proxy_server is imported; version 1.82.8 adds a .pth file that runs at Python startup and launches a detached process.
- The payload harvests SSH keys, cloud credentials, Kubernetes secrets, cryptocurrency wallets and .env files.
- Using a Kubernetes service account token when available, the malware can deploy privileged pods across cluster nodes and install a systemd user-service backdoor.
- The backdoor polls checkmarx[.]zone for additional payloads; harvested data is sent as an encrypted tpcp.tar.gz archive to models.litellm[.]cloud. A URL containing youtube[.]com acts as a kill switch.
- Recommended response includes removing affected versions and persistence, isolating hosts, checking clusters and egress logs, auditing CI/CD use of Trivy and KICS, and rotating exposed credentials.
Article Details
- Event Type
- Software supply-chain compromise involving malicious LiteLLM package releases
- Impact
- LiteLLM versions 1.82.7 and 1.82.8 contained code that harvested credentials, deployed privileged Kubernetes pods across cluster nodes, installed a persistent systemd backdoor, and exfiltrated collected data. The article says the versions were removed from PyPI and that the compromise likely stemmed from LiteLLM's use of Trivy in its CI/CD workflow.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | checkmarx[.]zone | Domain contacted by the systemd backdoor to retrieve URLs for next-stage payloads. |
| DOMAIN | models[.]litellm[.]cloud | Command-and-control domain receiving the encrypted archive of harvested data. |
MITRE ATT&CK
T1041 · Exfiltration Over C2 ChannelHarvested data was sent to the command-and-control domain in an encrypted archive via HTTPS POST.T1059.006 · PythonPython scripts and a Python subprocess were used to decode and execute the payload.T1071.001 · Web ProtocolsThe backdoor polled its next-stage payload endpoint over HTTPS.T1543.002 · Systemd ServiceThe payload installed a persistent systemd user service.T1552.001 · Credentials In FilesThe payload harvested credentials from .env files and other credential-bearing files.T1552.004 · Private KeysThe credential harvester searched for SSH keys.T1610 · Deploy ContainerThe malware used a Kubernetes service account token to deploy privileged pods to cluster nodes.
People
Gal NagliWiz head of threat exposure who publicly described the chain from the Trivy compromise through LiteLLM to credential exposure and further compromises.Kiran RajEndor Labs researcher who described the three-stage payload, including credential harvesting, Kubernetes lateral movement, and the systemd backdoor.
Threat Actors
Vendors
Endor LabsMultiple security vendors, including Endor Labs and JFrog, revealed that litellm versions 1.82.7 and 1.82.8 were published on March 24, 2026, likely stemming from the package’s use of Trivy in their CI/CD workflow.JFrogMultiple security vendors, including Endor Labs and JFrog, revealed that litellm versions 1.82.7 and 1.82.8 were published on March 24, 2026, likely stemming from the package’s use of Trivy in their CI/CD workflow.Socket“TeamPCP is escalating a coordinated campaign targeting security tools and open source developer infrastructure, and is now openly taking credit for multiple follow-on attacks across ecosystems,” Socket said.Wiz“The open source supply chain is collapsing in on itself,” Gal Nagli, head of threat exposure at Google-owned Wiz, said in a post on X.
Products
Kubernetespublishing backdoored versions 1.82.7 and 1.82.8 on PyPI that include a credential harvester, a Kubernetes lateral-movement toolkit, and a persistent systemd backdoor.LiteLLMTeamPCP has compromised the popular Python package litellm, publishing backdoored versions 1.82.7 and 1.82.8 on PyPI that include a credential harvester, a Kubernetes lateral-movement toolkit, and a persistent systemd
Tools
KICSto models.litellm[.]cloud as “tpcp.tar.gz”, and is part of a wider supply-chain campaign affecting Trivy, KICS, GitHub Actions, Docker Hub, npm, and Open VSX.Trivydata to models.litellm[.]cloud as “tpcp.tar.gz”, and is part of a wider supply-chain campaign affecting Trivy, KICS, GitHub Actions, Docker Hub, npm, and Open VSX.