TeamPCP LiteLLM Malicious Package Indicators
This detection helps you spot activity linked to TeamPCP LiteLLM PyPI compromise (litellm 1.82.7 / 1.82.8) using the specific indicators in the linked source. It is written to be high confidence by focusing on exact versions, domains, paths, or file fingerprints that were observed in the reporting. A match does not prove a system is compromised by itself, but it is a strong reason to investigate. Confirm the affected host and user, check whether the access was expected, and review nearby activity for follow-on steps like additional downloads, new persistence, or repeated connections. Use the source link to support incident.
Microsoft Sentinel (KQL)
