A Stolen Token Backdoored the LiteLLM PyPI Package
Nobody exploited LiteLLM's code — they stole its publishing key and shipped the backdoor as an official release.
| When | March 2026 |
|---|---|
| Target | LiteLLM (LLM gateway) on PyPI |
| Researcher | Datadog Security Labs |
| Technique | Publish-token theft → backdoored package (actor 'TeamPCP') |
| Status | GHSA-5mg7-485q-xm76 (no CVE); quarantined after ~2.5 hours |
- 1Attackers compromise a scanner in LiteLLM's CI/CD and steal its PyPI publish token
- 2They push backdoored releases: v1.82.7 (payload in proxy_server.py) and v1.82.8 (adds an auto-executing .pth file)
- 3The backdoor harvests cloud, SSH and Kubernetes credentials before PyPI quarantines it
What happened
In March 2026, the actor 'TeamPCP' published backdoored versions of LiteLLM — a widely-used LLM gateway — to PyPI. Datadog Security Labs traced it to a compromised Trivy scanner in LiteLLM's CI/CD pipeline, which let the attackers steal the project's publishing token and push malicious wheels (v1.82.7 and v1.82.8) as if they were the maintainers. PyPI's incident report puts the exposure at 2 hours 32 minutes from upload to quarantine, in which time the malicious versions were downloaded more than 119,000 times.
How the attack worked
In v1.82.7 the payload was injected into proxy_server.py and ran when the proxy module was imported; v1.82.8 also added a litellm_init.pth file, which Python executes automatically at interpreter start-up — so the backdoor ran with no import or call required. It harvested cloud, SSH and Kubernetes credentials, attempted Kubernetes lateral movement, and installed systemd persistence.
Root cause
A supporting tool inside the build pipeline was trusted with access to a publishing token, so compromising the pipeline was enough to ship an 'official' backdoor to every downstream installer.
Why it matters
Core AI-stack packages are installed on servers everywhere. A single stolen publish token turns one project's CI into a mass credential-harvesting event.
How to prevent it
- Pin and hash-verify dependencies; don't float to latest.
- Isolate and least-privilege CI/CD and publishing tokens.
- Monitor for unexpected new releases of critical AI-stack packages.
FAQ
How did the attackers publish backdoored versions?
They didn't exploit LiteLLM's code — they stole its PyPI publishing token by compromising a Trivy security scanner in the project's own CI/CD pipeline, then pushed malicious releases as if they were the maintainers.
Why is a .pth file dangerous?
Python executes .pth files at interpreter start-up, so a backdoor placed there runs whenever Python starts — no import or call needed. v1.82.8 used this to harvest cloud/SSH/Kubernetes credentials and establish persistence; v1.82.7 carried the same payload inside proxy_server.py instead.
What's the defence?
Pin and hash-verify dependencies, isolate and least-privilege CI/CD and publishing tokens, and monitor for unexpected new releases of critical AI-stack packages.
Sources
- LiteLLM and Telnyx compromised on PyPI: Tracing the TeamPCP supply chain campaign — Datadog Security Labs
- Two LiteLLM versions published containing credential harvesting malware (GHSA-5mg7-485q-xm76) — GitHub Advisory Database
- Incident Report: LiteLLM/Telnyx supply-chain attacks, with guidance — The Python Package Index Blog