Overview
- LiteLLM, an open-source API gateway used to route calls to more than 100 AI providers, shipped two PyPI versions that hid backdoors before the packages were removed.
- Endor Labs links the operation to the group TeamPCP, which allegedly used a previously breached Trivy scanner inside LiteLLM’s CI/CD to gain release access.
- The malicious updates carried a three-step payload that stole credentials, moved across Kubernetes clusters, and planted a persistent backdoor posing as a system telemetry service.
- One version ran hidden code when a module loaded, and the next used a .pth autorun file that executes on any Python start, with data sent to a look‑alike domain using strong encryption.
- Users are advised to confirm they are on the last known safe release (1.82.6), search for a litellm_init.pth file, rotate all cloud and SSH keys plus CI tokens, and audit recent pipeline and cluster activity.