Executive Summary
In March 2026, the threat actor TeamPCP successfully compromised the `litellm` library on PyPI, affecting versions 1.82.7 and 1.82.8. This incident is part of a broader month-long campaign targeting security-adjacent tools including Aqua Trivy and Checkmarx KICS across GitHub Actions, Docker Hub, and npm. The compromise is particularly dangerous because version 1.82.8 introduced a `.pth` file injection, which triggers the malicious payload on any Python invocation in the environment, even if the library is not imported.
Once executed, the malware performs an extensive sweep for cloud provider tokens (AWS, GCP, Azure), Kubernetes secrets, SSH keys, and cryptocurrency wallets. It also attempts to escalate privileges within Kubernetes clusters by deploying privileged pods to every node to install persistent backdoors. Detection engineers should prioritize monitoring for the specific persistence artifacts and the unusual C2 domains, as the attacker effectively bypassed standard integrity checks by regenerating package metadata.