Executive Summary
TeamPCP orchestrated a sophisticated multi-ecosystem supply chain campaign that targeted developer tooling, specifically the Trivy vulnerability scanner and LiteLLM AI gateway. By exploiting a misconfigured GitHub Action in Trivy, the attackers harvested credentials that allowed them to publish trojanized versions of LiteLLM (1.82.7 and 1.82.8) to PyPI. These malicious packages contained a three-stage payload designed for massive credential harvesting, Kubernetes lateral movement, and persistent remote access.
The attack is technically notable for using Python '.pth' files to achieve execution on every interpreter startup, effectively bypassing the need for a user to explicitly import the compromised module. The payload targeted over 50 categories of secrets, including AWS/Azure/GCP credentials, SSH keys, and critically, LLM API keys. This incident underscores a growing 'concentration of risk' where AI proxy services, which centralize high-value API keys for multiple model providers, become primary targets for supply chain actors.
While PyPI removed the affected versions within hours, the campaign affected numerous downstream projects including DSPy, MLflow, and CrewAI. The actor's operational maturity was demonstrated by a global 'kill switch' (a YouTube URL check) and the use of AdaptixC2 infrastructure hosted on bulletproof hosting. Organizations using LiteLLM or Trivy-based CI/CD workflows should immediately audit for persistence and rotate all potentially exposed secrets.