TeamPCP’s LiteLLM Supply-Chain Attack Stole Credentials and Installed a Backdoor

Mar 26, 2026 · Original article ↗

Summary

Compromised LiteLLM versions 1.82.7 and 1.82.8 harvested credentials and could establish persistent access. The article traces the attack to TeamPCP’s wider campaign, describes the payload, and outlines remediation.

Key points

Malicious LiteLLM versions 1.82.7 and 1.82.8 were published to PyPI after TeamPCP compromised CI/CD tooling in a wider supply-chain campaign.
Version 1.82.8 added a .pth file that ran at Python startup; both versions could harvest credentials, including cloud secrets, SSH keys, Kubernetes secrets, and LLM API keys.
The payload encrypted stolen data and sent it to attacker-controlled infrastructure; it also installed a persistent backdoor and contained code for Kubernetes cluster-wide access.
The attack followed a compromise of Trivy-related GitHub Actions, which exposed a PyPI publishing token through LiteLLM’s CI/CD pipeline.
PyPI removed the affected versions about three hours after reports emerged. No public confirmation indicated whether stolen credentials were successfully used.
The article recommends checking for the malicious file and persistence artifacts, rotating credentials on affected systems, blocking listed infrastructure, and pinning dependencies with hash verification.

Article Details

Attack Vectors: A misconfigured pull_request_target workflow in Trivy's CI enabled theft of the aqua-bot Personal Access Token. Aqua Security reported that subsequent credential rotation was not atomic and attackers may have obtained refreshed tokens.
Still-valid credentials enabled malicious replacement of 76 of 77 trivy-action release tags and all seven setup-trivy tags. The compromised scanner harvested runner secrets while still producing normal scan output, according to CrowdStrike.
The compromised Trivy execution in LiteLLM's CI/CD pipeline stole its PYPI_PUBLISH token, enabling direct publication of malicious LiteLLM versions 1.82.7 and 1.82.8 to PyPI.
LiteLLM 1.82.7 injected malicious code into proxy_server.py. Version 1.82.8 retained that injection and added LiteLLM_init.pth, triggering execution on subsequent Python interpreter startups without requiring a LiteLLM import.
The payload collected cloud credentials, SSH keys, Kubernetes secrets, application credentials, cryptocurrency wallet material, and CI/CD secrets, then encrypted and exfiltrated the collection.
Code could deploy privileged Kubernetes pods to cluster nodes, mount host filesystems, and install persistent backdoors through chroot. The article does not confirm that this lateral movement was exploited in the wild.
A systemd user service provided persistent polling and remote executable delivery. A YouTube-based kill switch was active during analysis, and second-stage execution was not confirmed.
CanisterWorm stole npm publishing tokens and automatically published malicious versions of accessible packages, extending the compromise across the npm ecosystem.
Compromised credentials were also used to hijack KICS GitHub Action tags and publish malicious Docker images. Two malicious VS Code extensions appeared on OpenVSX.
A fake checkmarx-util package was distributed directly from attacker-controlled infrastructure and used a postinstall hook for automatic execution.
Community analysis reported compromised GitHub accounts flooding the disclosure issue with comments; the article assesses that this likely sought to delay triage.
Defensive Notes: Check Python site-packages for LiteLLM_init.pth; the article recommends assuming full credential compromise if it is present.
Rotate all credentials exposed through environment variables or configuration files on systems that installed LiteLLM 1.82.7 or 1.82.8, including CI/CD runners and LLM API keys.
Remove reliance on affected releases and audit transitive dependencies, including downstream projects that may introduce the compromised package indirectly.
Block the reported attacker infrastructure at DNS and firewall layers and enforce outbound domain allowlisting.
Search Linux systems for sysmon.service and ~/.config/sysmon/.
Audit npm packages for checkmarx-util references and postinstall hooks that inspect GITHUB_ACTIONS.
Pin security scanners, package versions, and cryptographic hashes; enforce hash verification and software bills of materials.
Disable npm installation scripts in CI/CD unless explicitly reviewed.
Alert on unexpected .pth creation outside a known-good baseline and on bulk reads of credential files, cloud configurations, and wallet material.
Monitor JARM fingerprints associated with the reported infrastructure and investigate unexpected TLS connections to bulletproof hosting networks.
Treat fork bombs and unexplained resource exhaustion as possible supply chain compromise signals.
Use short-lived provider tokens where available and treat centralized LLM API key storage as a high-impact credential exposure point.
Successful downstream use of stolen credentials was not publicly confirmed. Model poisoning was theoretical and was not implemented in the analyzed payload.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`checkmarx[.]zone`	Attacker-controlled infrastructure directly serving the malicious checkmarx-util package.
DOMAIN	`litellm[.]cloud`	Attacker infrastructure associated with the second C2 node and explicitly listed for blocking.
DOMAIN	`models[.]litellm[.]cloud`	Reported LiteLLM credential-exfiltration endpoint, also identified in the article's infrastructure and ATT&CK discussion.
DOMAIN	`scan[.]aquasecurtiy[.]org`	Typosquatted exfiltration domain used by the compromised Trivy GitHub Actions payload.
IPV4	`45[.]148[.]10[.]212`	Reported resolution address of the Trivy credential-exfiltration domain.
IPV4	`46[.]151[.]182[.]203`	Reported second C2 node associated with LiteLLM[.]cloud and the exfiltration infrastructure.
IPV4	`83[.]142[.]209[.]11`	Seed IOC and reported C2 node associated with checkmarx[.]zone.