LiteLLM Was Backdoored: What the TeamPCP Supply Chain Attack Means for Python AI Projects

On March 24, 2026, threat actor TeamPCP published two compromised versions of LiteLLM to PyPI. If you work with Python AI tooling, this one is worth understanding in detail, because the attack technique will be reused. What Happened Versions 1.82.7 and 1.82.8 of LiteLLM contained malicious payloads after attackers obtained the maintainer's PyPI credentials. The credential theft wasn't a direct attack on LiteLLM. It was the third step in a cascade: March 19: TeamPCP compromised Trivy, an open-source security scanner March 21: Used the compromised Trivy action to steal credentials from Checkmarx's CI pipeline March 24: Used stolen credentials from LiteLLM's CI/CD pipeline (which ran Trivy) to publish malicious packages The malicious versions executed in two different ways. Version 1.82.7 embedded a base64-encoded payload in litellm/proxy/proxy_server.py ; it fires when anything imports litellm.proxy . Version 1.82.8 was more aggressive: it added a litellm_init.pth file to site-packages,