LiteLLM Hit by Lightning Cyberattack Orchestrated by TeamPCP

A Carefully Orchestrated Attack

On March 24, 2026, cybersecurity company Snyk revealed a sophisticated attack against LiteLLM, a crucial Python library for millions of developers. This offensive, carried out by the hacker group TeamPCP, was meticulously planned over a period of five days. The attackers used compromised security tools, including Trivy and Checkmarx KICS, to insert malicious code into LiteLLM. This maneuver allowed for the exfiltration of sensitive data belonging to developers.

In response to this threat, PyPI quickly acted by quarantining the compromised versions of LiteLLM. Strict recommendations were issued for affected users, including the necessity to completely reset compromised systems to ensure data security.

Timeline of the Attack

On March 24, at 11:48 AM, Callum McMahon, a researcher at FutureSearch, published an alert after his machine became unusable following an update to LiteLLM. Upon examining the package, he discovered the presence of malicious code. LiteLLM, downloaded 3.4 million times a day, is an essential tool in the artificial intelligence ecosystem, facilitating the transition between different language models.

The attack on LiteLLM represents the ninth phase of a methodical campaign initiated on March 19, targeting Trivy. TeamPCP successfully substituted a malicious version of this tool in the official distribution channel. On March 23, another compromised version of Checkmarx KICS was introduced, and two domains were registered to receive the stolen data.

On March 24 at 10:39 AM, LiteLLM used Trivy without a fixed version precaution, thereby exposing a secret key. In just thirteen minutes, TeamPCP released two booby-trapped versions of LiteLLM.

Consequences of the Attack

The compromised versions of LiteLLM contained a three-step malicious program. The first step involved silent data exfiltration, including SSH keys, passwords, and cloud credentials. Next, the exfiltrated data was sent, in encrypted form, to servers controlled by TeamPCP. Finally, a persistent backdoor was installed, disguised as a system service, allowing continuous access to the compromised systems.

Reactions and Measures After the Incident

When the LiteLLM community raised the alarm on GitHub, TeamPCP attempted to downplay the severity of the incident by flooding the discussion with 88 automated comments. PyPI quarantined the malicious versions around 1:38 PM, approximately three hours after their release. The LiteLLM team revoked and replaced all access keys and migrated to new identities to enhance security.

Users who installed versions 1.82.7 or 1.82.8 of LiteLLM during this period should consider their machines compromised. It is imperative to revoke all keys and passwords, and to audit cloud and Kubernetes access to prevent any future compromise.