As cited
Copy frozen at (site build).
threat intel
Three’s a Crowd: TeamPCP trojanizes LiteLLM in Continuation of Campaign
TeamPCP compromised LiteLLM, a popular open-source library, by releasing trojanized versions 1.82.7 and 1.82.8 that used Python's .pth file mechanism for persistence. The malware exfiltrated cloud credentials, CI/CD secrets, and API keys to attacker-controlled infrastructure. This represents an ongoing pattern of TeamPCP targeting open-source software supply chains.
Why it matters: Developers using LiteLLM in those versions are at risk of credential compromise affecting cloud accounts, deployment pipelines, and API access; immediate upgrade to patched versions and credential rotation are critical.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
Three’s a Crowd: TeamPCP trojanizes LiteLLM in Continuation of Campaign
TeamPCP compromised LiteLLM versions 1.82.7 and 1.82.8 by injecting malicious code that uses Python's .pth mechanism to achieve persistent execution. The trojanized packages exfiltrate cloud credentials, CI/CD secrets, and encryption keys to attacker-controlled infrastructure. This represents the latest in an ongoing campaign targeting open-source software supply chains.
Why it matters: Organizations using LiteLLM in their development or production environments face immediate risk of credential theft and lateral movement if they installed the affected versions; urgent review and remediation are required.
- Source published
- First seen by Cybersecurity Tracker