Malicious LiteLLM PyPI package compromises developer systems with credential stealer
Threat actor TeamPCP injected malicious code into versions 1.82.7 and 1.82.8 of the widely-downloaded litellm Python package on PyPI, creating a backdoor that harvests credentials and cloud secrets from developer systems. The compromised packages remained available for at least two hours before detection by security researchers.
What happened
Versions 1.82.7 and 1.82.8 of the litellm Python package were published to PyPI containing malicious code injected by threat actor TeamPCP. Version 1.82.8 contains a .pth file named 'litellm_init.pth' that executes on every Python process startup without requiring import calls, while version 1.82.7 requires an import to activate.
The malicious releases remained available on PyPI for at least two hours. The three-stage payload harvests SSH keys, environment variables, AWS credentials, GCP service account tokens, Azure secrets, Kubernetes configuration files, database passwords, .gitconfig, shell history, and cryptocurrency wallet files, then encrypts and exfiltrates them with RSA-4096 and AES-256-CBC encryption.
Reported impact
LiteLLM receives over 95 million monthly downloads and sits deep in the AI tooling stack. The malicious packages posed exposure to developer laptops, CI/CD runners, and cloud infrastructure.
Independent analysis by FutureSearch identified the compromise when a transitive dependency pulled into an MCP plugin caused a runaway fork bomb and exhausted system RAM.
Index analysis
Sonatype Security Research Team tracked the malicious releases as sonatype-2026-001357. The compromised package's high distribution rate amplified risk during the release window.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.