---
id: 6881
title: "Three’s a Crowd: TeamPCP trojanizes LiteLLM in Continuation of Campaign"
source_domain: wiz.io
source_url: "https://www.wiz.io/blog/threes-a-crowd-teampcp-trojanizes-litellm-in-continuation-of-campaign"
published_at: "2026-03-24T18:40:52Z"
tags: ["cloud", "supply-chain", "malware", "credential-theft", "pypi", "litellm", "persistence", "teampcp"]
phying_url: "https://phying.com/item/6881"
lang: en
---

# Three’s a Crowd: TeamPCP trojanizes LiteLLM in Continuation of Campaign

## Summary

TeamPCP trojanized LiteLLM with malicious PyPI versions 1.82.7 and 1.82.8: the payloads abuse Python's .pth mechanism to run base64 payloads at startup, exfiltrating cloud and CI/CD credentials.

## Intelligence Metadata

- **Sources:** wiz.io
- **Published:** 2026-03-24T18:40:52Z
- **Original:** https://www.wiz.io/blog/threes-a-crowd-teampcp-trojanizes-litellm-in-continuation-of-campaign
- **Phying News:** https://phying.com/item/6881