33K Exposed LiteLLM Deployments and the C2 Servers Behind TeamPCP's Supply Chain Attack

Malicious PyPI builds of LiteLLM 1.82.7/1.82.8, published via a compromised maintainer account, exfiltrated API keys and system data, exposing a user's entire LLM provider surface.

TeamPCP trojanized LiteLLM with malicious PyPI versions 1.82.7 and 1.82.8: the payloads abuse Python's .pth mechanism to run base64 payloads at startup, exfiltrating cloud and CI/CD credentials.

TeamPCP hit durabletask 1.4.1-1.4.3, Microsoft's Durable Task client: a hijacked account dumped a GitHub-stored PyPI token to push malware that steals credentials, spreading via AWS SSM.

Wiz CIRT tracked how TeamPCP turned secrets stolen in the Trivy, KICS, and LiteLLM attacks into cloud intrusions — validating credentials with TruffleHog and exploring environments within hours.

Software supply chain attacks in 2023 cluster into three categories: package manager attacks like dependency confusion and typosquatting, developer compromise, and breaches at large software vendors.

From typosquatting to poisoned pipelines, supply chain attacks exploit implicit trust in package registries; tools like TypoGard, Zizmor, and PyPI Trusted Publishing make trust verifiable.