49.2K
ARLiteLLM was hacked yesterday by a group called TeamPCP and the entry point was the security scanner LiteLLM used to protect itself.
TeamPCP has been running a coordinated campaign all week. They hit Trivy (a popular security scanning tool) on March 19, then used that foothold to steal LiteLLM’s PyPI publishing credentials five days later. This was phase 9 of an ongoing operation that has quietly worked its way through the AI tooling supply chain.
What the video couldn’t cover:
The two poisoned versions (1.82.7 and 1.82.8) were live for roughly 3 hours between 08:30 and 11:25 UTC on March 24. Version 1.82.8 was the more dangerous one — it included a file called litellm_init.pth that triggered the malware automatically on every Python startup, even if you never imported LiteLLM directly. That means transitive installs through packages like dspy were enough to get compromised.
The stolen credentials were encrypted using AES-256 and RSA before being exfiltrated to a domain the attackers registered the night before the attack. The malware also attempted to move laterally through Kubernetes clusters and install a persistent backdoor.
If you were affected, here is what to do right now:
Run pip show litellm and check your version. If it’s 1.82.7 or 1.82.8, assume full compromise. Rotate every credential on that machine — cloud keys, SSH keys, database passwords, LLM API keys, GitHub tokens, everything. Check for a file called litellm_init.pth in your Python environment and delete it. Look for a folder at ~/.config/sysmon on your machine and remove it if it exists.
The official PyPI advisory is PYSEC-2026-2. The LiteLLM maintainers have confirmed that everything up to version 1.82.6 is clean.
#ai #artificialintelligence #chatgpt #technews #fyp
@arnitly
![#Teampcp Reel by @iamrahultyagi - [ 2 Minute VIDEO] TeamPCP Supply Chain Attack: How the Trivy & LiteLLM Hack Exposed Global Secrets EXPLAINED!
From automated shadow vendor discovery](https://image.pictame.com/img/657686244_18570755989023713_6961345201902586809_n.jpg?hash=aHR0cHM6Ly9zY29udGVudC1wcmcxLTEuY2RuaW5zdGFncmFtLmNvbS92L3Q1MS44Mjc4Ny0xNS82NTc2ODYyNDRfMTg1NzA3NTU5ODkwMjM3MTNfNjk2MTM0NTIwMTkwMjU4NjgwOV9uLmpwZz9zdHA9ZHN0LWpwZ19lMzVfczY0MHg2NDBfdHQ2Jl9uY19jYXQ9MTA4JmNjYj03LTUmX25jX3NpZD0xOGRlNzQmZWZnPWV5SmxabWRmZEdGbklqb2lRMHhKVUZNdVltVnpkRjlwYldGblpWOTFjbXhuWlc0dVF6TWlmUSUzRCUzRCZfbmNfb2hjPUZNaG5SRVd4UjF3UTdrTnZ3SHhuVkgtJl9uY19vYz1BZHBiU2FLanJKTlN2Mlo3Vnc3U29CUm9ON21hRVd5cUU3dFRzOGdPYTRmSHZ3Q1RGQlhVVThsRVRUQU5LR21pNkZVJl9uY196dD0yMyZfbmNfaHQ9c2NvbnRlbnQtcHJnMS0xLmNkbmluc3RhZ3JhbS5jb20mX25jX2dpZD0zekhXQkF3SDRfcUdnRThRa2lXRU93Jl9uY19zcz03YTM4OSZvaD0wMF9BZjB0aW40MklNMmxET3RTSk1LalEwbHhaeEo0S2haUVcyR0tBTTctSFFnbFd3Jm9lPTY5RDMwODk4)
