TeamPCP-Linked Supply-Chain Attack Compromises LiteLLM PyPI Releases
Summary
Researchers say malicious LiteLLM versions 1.82.7 and 1.82.8 steal credentials and install persistence. Reports of about 500,000 data exfils remain independently unconfirmed; version 1.82.6 is identified as clean.
Key points
- Endor Labs reports that malicious LiteLLM versions 1.82.7 and 1.82.8 were published to PyPI with payloads that execute when imported.
- Version 1.82.8 adds a .pth file that runs malicious code whenever Python starts.
- The payload targets SSH keys, cloud credentials, Kubernetes secrets, TLS keys, CI/CD secrets, database credentials, wallets, and environment files.
- The reported payload attempts Kubernetes lateral movement and installs a persistent systemd backdoor; stolen data is encrypted and sent to models.litellm[.]cloud.
- Sources estimated about 500,000 data exfils, many duplicates, but BleepingComputer could not independently confirm the figure.
- The malicious releases were removed from PyPI, and version 1.82.6 is identified as clean. Recommended actions include rotating exposed credentials, checking for persistence, and inspecting Kubernetes clusters.
Article Details
- Victim Organization
- LiteLLM
- Incident Type
- Supply-chain compromise involving malicious LiteLLM package releases that deploy credential-stealing malware and persistence mechanisms.
- Data Types Exposed
- SSH keys and configuration files
- Cloud credentials and tokens
- Kubernetes service account tokens and cluster secrets
- Environment files
- Database credentials and configuration files
- TLS private keys
- CI/CD secrets
- Cryptocurrency wallet data
- Affected Records
- Sources reported approximately 500,000 data exfils, many of them duplicates; BleepingComputer could not independently confirm the number.
- Operational Impact
- Malicious LiteLLM versions 1.82.7 and 1.82.8 reportedly execute a payload on import; version 1.82.8 also installs a .pth file that runs on Python startup. The payload harvests credentials, attempts lateral movement across Kubernetes clusters, installs persistence, and exfiltrates data. The article recommends removing affected versions, rotating exposed secrets, hunting for persistence artifacts, and inspecting Kubernetes clusters.
- Ransom Or Extortion
- None reported
- Claim Status
- claimed
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | checkmarx[.]zone | Remote server contacted by the persistence script to download and execute additional payloads. |
| DOMAIN | models[.]litellm[.]cloud | Attacker-controlled domain identified as the destination for encrypted exfiltrated data. |
MITRE ATT&CK
T1005 · Data from Local SystemThe payload collects credentials, keys, wallet data, and other information from infected systems.T1041 · Exfiltration Over C2 ChannelThe article reports encrypted data exfiltration to attacker-controlled infrastructure.T1543.002 · Systemd ServiceThe payload installs a persistent systemd user service that periodically contacts a remote server.T1552.001 · Credentials In FilesThe payload harvests credentials and secrets from files, including SSH keys, environment files, and configuration files.T1610 · Deploy ContainerThe payload attempts lateral movement across Kubernetes clusters by deploying privileged pods to nodes.
Threat Actors
Malware
Vendors
Aqua SecurityThe attack has been claimed by TeamPCP, a hacking group that was behind the recent high-profile breach of Aqua Security’s Trivy vulnerability scanner.CheckmarxThat breach is believed to have led to cascading compromises that impacted Aqua Security Docker images, Checkmarx KICS project, and now LiteLLM.
Products
KICSThat breach is believed to have led to cascading compromises that impacted Aqua Security Docker images, Checkmarx KICS project, and now LiteLLM.LiteLLMTeamPCP compromised the widely used LiteLLM Python package on PyPI, publishing malicious 1.82.7 and 1.82.8 releases that install an infostealer and persistence mechanisms.TrivyThe campaign, linked to the Trivy supplyâchain breach, reportedly exfiltrated data from roughly 500,000 devices and requires immediate secret rotation, artifact hunting, and Kubernetes inspection.