A Stolen Token Backdoored the LiteLLM PyPI Package
Nobody exploited LiteLLM's code — they stole its publishing key and shipped the backdoor as an official release.
| When | March 2026 |
|---|---|
| Target | LiteLLM (LLM gateway) on PyPI |
| Researcher | Datadog Security Labs |
| Technique | Publish-token theft → backdoored package (actor 'TeamPCP') |
| Status | GHSA-5mg7-485q-xm76 (no CVE); quarantined within hours |
- 1Attackers compromise a scanner in LiteLLM's CI/CD and steal its PyPI publish token
- 2They push backdoored wheels (v1.82.7 / v1.82.8) that auto-execute via a .pth file
- 3The backdoor harvests cloud, SSH and Kubernetes credentials before PyPI quarantines it
What happened
In March 2026, the actor 'TeamPCP' published backdoored versions of LiteLLM — a widely-used LLM gateway — to PyPI. Datadog Security Labs traced it to a compromised Trivy scanner in LiteLLM's CI/CD pipeline, which let the attackers steal the project's publishing token and push malicious wheels (v1.82.7 and v1.82.8) as if they were the maintainers. PyPI quarantined them within a few hours.
How the attack worked
The malicious wheels planted code in a .pth file, which Python executes automatically at interpreter start-up — so the backdoor ran on import with no call required. It harvested cloud, SSH and Kubernetes credentials, attempted Kubernetes lateral movement, and installed systemd persistence.
Root cause
A supporting tool inside the build pipeline was trusted with access to a publishing token, so compromising the pipeline was enough to ship an 'official' backdoor to every downstream installer.
Why it matters
Core AI-stack packages are installed on servers everywhere. A single stolen publish token turns one project's CI into a mass credential-harvesting event.
How to prevent it
- Pin and hash-verify dependencies; don't float to latest.
- Isolate and least-privilege CI/CD and publishing tokens.
- Monitor for unexpected new releases of critical AI-stack packages.
FAQ
How did the attackers publish backdoored versions?
They didn't exploit LiteLLM's code — they stole its PyPI publishing token by compromising a Trivy security scanner in the project's own CI/CD pipeline, then pushed malicious releases as if they were the maintainers.
Why is a .pth file dangerous?
Python executes .pth files at interpreter start-up, so a backdoor placed there runs automatically on import — no call needed. The wheels used this to harvest cloud/SSH/Kubernetes credentials and establish persistence.
What's the defence?
Pin and hash-verify dependencies, isolate and least-privilege CI/CD and publishing tokens, and monitor for unexpected new releases of critical AI-stack packages.
Sources
- LiteLLM Compromised: The TeamPCP PyPI Supply-Chain Campaign — Datadog Security Labs
- Malicious LiteLLM versions (GHSA-5mg7-485q-xm76) — GitHub Advisory Database