Three’s a Crowd: TeamPCP trojanizes LiteLLM in Continuation of Campaign

LiteLLM is the latest victim of TeamPCP’s open-source attack spree. Malicious versions 1.82.7 and 1.82.8 abuse Python’s .pth mechanism for stealthy persistence. The malware exfiltrates cloud credentials, CI/CD secrets, and keys to attacker-controlled domains.

LiteLLM is the latest victim in TeamPCP’s spree of attacks targeting the open source ecosystem. Previously, Wiz has covered the compromises of Aqua Security’sTrivyand a set of CheckmarxGitHub Actions and OpenVSX extensions. LiteLLM is an open-source Python library and proxy server that acts as a universal translator, converting API requests for over 100 different Large Language Models into the standard OpenAI format. Our data shows thatLiteLLM is present in 36% of cloud environments, signifying the potential for widespread impact.

Update 03/25:LiteLLM has published an official and actively maintainedSecurity Update.

Malicious versions of the LiteLLM python package (1.82.7and1.82.8) were published on the morning of 24 March 2026. The compromised packages employed two different methods to deliver their payload. The packages werepublished at approximately 8:30 UTCandquarantined by PyPI at 11:25 UTC. An PyPI advisory has been postedhere, identifying an API token exposed via theprior Trivy incidentas the root cause. Wiz customers can check their environment via theWiz Threat Center.

1.82.7 drops the double base64 encoded payload to disk and then runs it asp.pyand executes wheneverlitellm –proxyis run or whenlitellm.proxy.proxy_serveris imported.

1.82.8 includes the version used in 1.82.7 and also adds a more complex mechanism that causes the malicious code to be run whenever python is invoked.

The malicious package abuses python’s.pthfile mechanism, which allows arbitrary code execution during interpreter initialization. The package includes a malicious file (litellm_init.pth) that is triggered whenever python is invoked on the system, whether or not there is an explicit import of LiteLLM.

The file executes a double base64-encoded payload via subprocess, effectively bypassing simple inspection techniques. This provides stealthy and persistent execution across any Python process in the environment.

Once executed, the payload performs the same extensive data collection across the host seen in the KICSoperation. It targets environment variables (including API keys and tokens), SSH keys, cloud credentials (AWS, GCP, Azure), Kubernetes configs, CI/CD secrets, Docker configs, database credentials, and even cryptocurrency wallets. The collected data is encrypted using AES-256, with the key further encrypted using an embedded RSA public key, and exfiltrated to an attacker-controlled domain (checkmarx[.]zonein 1.82.7,models[.]litellm[.]cloudin 1.82.8).

The LiteLLM script utilizes the same basic and Kubernetes based persistence mechanisms seen in the KICS operation. They continue to usecheckmarx.zone/rawas the callout for their persistent python script.

Wiz customers should continue to monitor the advisory in theWiz Threat Centerfor ongoing guidance, pre-built queries, and references to relevant detections they can use to assess the risk  in their environment.

Checkmarx KICS scanner is the latest victim of a credential-stealing supply chain attack by TeamPCP. Between 12:58–16:50 UTC on March 23, 35 tags were hijacked. Learn how to audit your workflows, identify malicious activity, and secure your GitHub Actions.

Red Agent is an AI-powered, context-aware attacker that uncovers complex exploitable risks across your entire attack surface, continuously and at scale.

Secure every layer of AI applications — infrastructure, data, access, models, agents, and applications — from code to runtime, across every environment you build in.

Get a personalized demo

©2026Wiz, Inc.

StatusPrivacy PolicyTerms of UseModern Slavery StatementCookie Settings