LiteLLM and PyTorch Lightning Supply Chain Attack
Threat actor TeamPCP executed a targeted supply chain attack by compromising PyPI maintainer credentials to inject malicious code into LiteLLM (v1.82.7, 1.82.8) and PyTorch Lightning (v2.6.2, 2.6.3). The attackers utilized .pth file manipulation to achieve silent code execution during Python interpreter initialization, bypassing traditional import-based detection. The campaign exfiltrated 153GB of data—including AWS, GCP, Azure tokens, SSH keys, and CI/CD secrets—from approximately 2,500 organizations. The attack window lasted three hours before PyPI quarantine, highlighting a systemic shift toward targeting AI infrastructure and leveraging "slopsquatting" to exploit LLM-generated package hallucinations.
LiteLLM Supply Chain Compromise and AI Gateway Backdoor
LiteLLM, a centralized LLM orchestration library, was targeted in a supply chain attack involving the distribution of malicious PyPI packages. Attackers integrated obfuscated Python code to establish a backdoor within the library's initialization and request-handling logic. This compromise enables the exfiltration of high-privilege API keys and sensitive prompt metadata to attacker-controlled C2 infrastructure via outbound HTTP requests. By compromising the orchestration layer, threat actors gain an intercept point for all traffic routing to multiple LLM providers, creating a systemic risk for enterprise AI governance and enabling subsequent prompt injection attacks against integrated AI agents.