Apr 7, 2026

The LiteLLM Supply Chain Attack: How Developer Machines Became Credential Vaults

In March 2026, the TeamPCP threat actor compromised PyPI packages LiteLLM 1.82.7 and 1.82.8, injecting infostealer malware that turned developer workstations into credential harvesting engines.

Security

Tags (5)

# security # supply-chain # ai # litellm # malware

In March 2026, a sophisticated supply chain attack targeted LiteLLM, a popular AI development library downloaded millions of times daily. The threat actor, known as TeamPCP, poisoned versions 1.82.7 and 1.82.8 on PyPI, infecting developer machines worldwide with an info-stealing malware.

The attack vector

LiteLLM is a core dependency for many AI applications — it provides unified interfaces to multiple LLM providers. Developers trust it, and they install it frequently via pip install or requirements.txt. That trust was exploited.

The malicious packages contained a postinstall script that activated immediately upon installation. Once executed, the malware began harvesting credentials stored on the developer’s workstation: API keys, cloud credentials, SSH keys, and environment files.

Why this was so effective

1. High-value targets — Developer workstations are the most active piece of infrastructure in any tech company. They hold plaintext secrets for testing, staging, and sometimes production.
2. No verification needed — The malware didn’t need to exploit a vulnerability; it simply ran with the user’s permissions, accessing files the user could read.
3. Scale — LiteLLM has millions of daily downloads. Even if only a fraction installed the infected versions, the attacker gained access to thousands of developer machines in days.
4. Persistence — The infostealer could stay dormant, periodically exfiltrating new credentials as developers created them.

Impact

Organizations affected reported:

• compromised cloud accounts (AWS, GCP, Azure)
• stolen API keys for OpenAI, Anthropic, and other AI providers
• SSH keys used to access internal servers
• source code repositories with embedded secrets

The attack demonstrated that the developer laptop is now the most valuable target in the enterprise.

Mitigation lessons

• Never store plaintext secrets on developer machines — use secret management (Vault, AWS Secrets Manager) and short-lived credentials.
• Pin dependencies and use a private PyPI mirror to validate package integrity.
• Monitor postinstall scripts — any package that runs arbitrary code on install is a risk.
• Credential rotation — assume any developer machine could be compromised and rotate keys frequently.

The bigger picture

This attack is a wake-up call: AI supply chains are now critical infrastructure. As AI becomes embedded in every application, the libraries we depend on become high-value targets for espionage and financial gain.

The message is clear: secure your development environment, or risk giving away the keys to your kingdom.

Sources: The Hacker News (April 6, 2026), Check Point research.