Loading malware…
LiteLLM was the name of a trojanized PyPI package published as malicious versions 1.82.7 and 1.82.8 during the March 2026 TeamPCP software supply-chain campaign. The attackers used stolen publishing credentials obtained from an upstream CI/CD compromise to replace legitimate package releases with a Python-based credential-stealing payload while preserving expected package functionality. The malware targeted developer workstations and CI/CD environments that installed the affected package from PyPI.
The malicious LiteLLM package executed a base64-decoded stealer through Python code embedded in the package. In version 1.82.7, execution occurred when specific LiteLLM components were imported. In version 1.82.8, the attackers escalated impact by adding a Python .pth startup hook, causing the payload to run automatically whenever the Python interpreter started on the host, even if LiteLLM itself was never imported by the application. This provided broad execution and persistence across Python processes on affected systems.
Observed behavior linked the package to TeamPCP’s broader cloud-focused credential theft operations. The payload was associated with harvesting secrets and sensitive material from CI/CD and developer environments, including cloud credentials and Kubernetes-related data, and with encrypted exfiltration of collected information. Reporting also tied the LiteLLM compromise to lateral-movement tooling aimed at Kubernetes environments and to fallback exfiltration through abused GitHub infrastructure when direct network exfiltration failed. The compromise formed part of a larger intrusion chain that also affected Trivy, Checkmarx KICS, and other developer tooling, illustrating how stolen credentials from one supply-chain breach were reused to poison downstream packages.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The attackers then published malicious versions 1.82.7 and 1.82.8 directly to PyPI, bypassing the normal release process. The malware used a Python .pth file... every python, pip, or pytest command would trigger the credential stealer.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Poisoned versions 1.82.7 and 1.82.8 appeared on PyPI. Version 1.82.8 introduced a particularly dangerous technique: it dropped a .pth file (litellm_init.pth) that Python automatically processes at startup, causing the malware to execute on every Python process launched on the host—regardless of whether LiteLLM was imported in code.
29 distinct techniques documented for this family, organized by ATT&CK tactic.
Using these stolen publish tokens, the attackers hit PyPI to push versions 1.82.7 and 1.82.8 of LiteLLM... It authenticated to the GitHub API using the victim’s own stolen PAT
Following LiteLLM-driven credential theft, attackers reportedly use a compromised Tailscale VPN credential for initial access to Mercor’s infrastructure.
The irony is that Mercor was hacked via a third-party open source tool called LiteLLM.
Earlier this month, Mercor said that it was "one of thousands of companies" affected by the LiteLLM supply-chain attack.
The severity of this dependency was demonstrated in March 2026, when attackers compromised the LiteLLM package through dependency confusion, injecting malicious code directly into the request-handling pipeline of every deployment that pulled the poisoned release.
The threat actor modified these workflows to execute malicious code during CI runs...
Version 1.82.8 escalated - it added a litellm_init.pth file to site-packages that executes during every Python interpreter startup, not just when LiteLLM is imported.
The LiteLLM payload bypassed standard SAST tools through a technique known as .pth file injection . When a package containing a .pth file is installed in the Python site-packages directory, the interpreter automatically reads it during initialization before the primary script is ever executed or imported.
Version 1.82.8 escalated - it added a litellm_init.pth file to site-packages that executes during every Python interpreter startup... any Python process on the machine triggered the malware.
Using these stolen publish tokens, the attackers hit PyPI to push versions 1.82.7 and 1.82.8 of LiteLLM... It authenticated to the GitHub API using the victim’s own stolen PAT
Following LiteLLM-driven credential theft, attackers reportedly use a compromised Tailscale VPN credential for initial access to Mercor’s infrastructure.
These packages contained credential-stealing and backdoor code designed to harvest SSH keys, cloud credentials, Kubernetes secrets, database credentials, environment variables, and other sensitive data, while establishing persistent access to attacker-controlled infrastructure.
Version 1.82.8 escalated - it added a litellm_init.pth file to site-packages that executes during every Python interpreter startup... any Python process on the machine triggered the malware.
Using these stolen publish tokens, the attackers hit PyPI to push versions 1.82.7 and 1.82.8 of LiteLLM... It authenticated to the GitHub API using the victim’s own stolen PAT
The TeamPCP payload dropped a heavily obfuscated Base64-encoded execution string into a hidden .pth file ... During the Bitwarden CLI compromise on April 22, the core payload bw1.js was a massive 9.7 MB file processed through obfuscator.io, utilizing a 43,436-entry string lookup table
Using these stolen publish tokens, the attackers hit PyPI to push versions 1.82.7 and 1.82.8 of LiteLLM... It authenticated to the GitHub API using the victim’s own stolen PAT
The LiteLLM payload bypassed standard SAST tools through a technique known as .pth file injection . When a package containing a .pth file is installed in the Python site-packages directory, the interpreter automatically reads it during initialization before the primary script is ever executed or imported.
When the compromised action ran, it harvested LiteLLM’s PyPI publishing token.
Harvest : SSH keys, cloud credentials, Kubernetes secrets, crypto wallets, Slack/Discord tokens
Harvest : SSH keys, cloud credentials, Kubernetes secrets, crypto wallets, Slack/Discord tokens - and actively queried AWS APIs using stolen IMDS credentials.
The TeamPCP malware specifically sought out these directories, intercepting proprietary prompts and unencrypted model weights directly from the development lifecycle.
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A trojanized Python package used for supply-chain compromise. It leveraged .pth file injection to execute on interpreter startup, exfiltrate data, and in some cases establish persistence on developer systems.
Referenced as a prior malicious package in the same TeamPCP supply-chain campaign series. The same RSA key and exfiltration format are said to appear in the LiteLLM and telnyx attacks.
Compromised PyPI package releases published with stolen CI/CD credentials as part of the TeamPCP supply-chain campaign.
In this content, LiteLLM is discussed as a compromised package/tool in the TeamPCP supply chain campaign associated with secret theft and exfiltration from CI/CD environments.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.