LiteLLM PyPI supply chain backdoor — TeamPCP campaign compromises 3.4M daily downloads
Date: 2026-03
Affected: LiteLLM — 3.4M daily downloads; SSH keys, cloud tokens, K8s configs
Attack vector: supply-chain
Category: real-world
Severity: Critical

TeamPCP compromised LiteLLM (3.4M daily downloads) via a poisoned Trivy GitHub Action that stole the PYPI_PUBLISH token. Backdoored versions contained a three-stage credential harvester collecting SSH keys, cloud tokens, Kubernetes configs. Available ~3 hours before PyPI quarantine.

Impact: Mass credential theft potential; supply chain compromise; 3-hour exposure window

Mitigations:
GitHub Actions supply chain verification
Package integrity monitoring and rollback
PyPI publish token rotation and 2FA

Architectural layers (MAESTRO):
label: Agent Ecosystem
notes: CI/CD pipeline compromised to steal PyPI publish token
role: origin
label: Deployment & Infrastructure
notes: Three-stage credential harvester deployed via package install
role: impact