A Single pip install Just Compromised Thousands of AI Developers. Vibe Coding Made It Worse.

Yesterday, litellm versions 1.82.7 and 1.82.8 were published on PyPI with a three-stage backdoor. If you ran pip install litellm or had it as a dependency anywhere in your stack, a threat actor called TeamPCP may now have your SSH keys, AWS credentials, GCP tokens, Azure secrets, Kubernetes configs, crypto wallets, and database passwords. litellm has 97 million downloads per month. The malicious code executed at import time . No user interaction needed. Here's what happened. And here's why vibe coding makes this kind of attack exponentially more dangerous. What TeamPCP Actually Did TeamPCP compromised litellm through its own CI/CD pipeline. litellm used Trivy (a security scanner) in their build process. TeamPCP had already compromised Trivy's GitHub Action. Through that, they got PyPI credentials and pushed backdoored versions. The payload was three stages: Credential harvester : swept SSH keys, cloud credentials (AWS, GCP, Azure), Kubernetes secrets, cryptocurrency wallets, .env files