LiteLLM and PyTorch Lightning Supply Chain Attack

Threat actor TeamPCP executed a targeted supply chain attack by compromising PyPI maintainer credentials to inject malicious code into LiteLLM (v1.82.7, 1.82.8) and PyTorch Lightning (v2.6.2, 2.6.3). The attackers utilized .pth file manipulation to achieve silent code execution during Python interpreter initialization, bypassing traditional import-based detection. The campaign exfiltrated 153GB of data—including AWS, GCP, Azure tokens, SSH keys, and CI/CD secrets—from approximately 2,500 organizations. The attack window lasted three hours before PyPI quarantine, highlighting a systemic shift toward targeting AI infrastructure and leveraging "slopsquatting" to exploit LLM-generated package hallucinations.

• Incident Overview: AI Infrastructure Compromise

  • Target: High-value AI development environments acting as "honey pots" for centralized secrets.
  • Scope: Approximately 2,488 corporate domains impacted across technology, finance, and telecommunications sectors.
  • Scale: Exfiltration of 433,909 files totaling 153GB, delivered as a compressed RAR archive.

• Attack Vector: .pth Execution & Credential Theft

  • Vector: Compromised PyPI maintainer credentials allowed the injection of malicious code into trusted libraries.
  • Mechanism: Use of .pth files to trigger automatic execution upon Python interpreter startup, evading detection by tools monitoring standard import calls.
  • Payload Targets: Specifically designed to harvest cloud provider tokens (IAM), service account keys, SSH keys, and CI/CD pipeline secrets.

• Threat Actor Profile: TeamPCP and Slopsquatting

  • Group: TeamPCP, demonstrating advanced knowledge of Python internals and AI-specific development workflows.
  • Tactic: Implementation of "slopsquatting," registering packages that correspond to common hallucinations produced by LLM coding assistants.
  • Macro Trend: This campaign aligns with a reported 73% increase in malicious open-source packages throughout 2026.

• Indicators of Compromise & Defensive Actions

  • IoCs: Deployment of LiteLLM versions 1.82.7/1.82.8 or PyTorch Lightning versions 2.6.2/2.6.3.
  • Forensics: Audit logs for unauthorized access using cloud provider tokens and anomalous SSH key activity.
  • Mitigation: Immediate rotation of all cloud credentials and CI/CD secrets for environments where the compromised versions were installed.

• Conclusion: Systemic Risks in AI Supply Chains

  • Pivot: A strategic shift in adversary tactics toward the software supply chains powering global AI transitions.
  • Vulnerability: The high concentration of privileged credentials within AI dev environments creates a massive blast radius for single-package compromises.
  • Future Outlook: Requirement for enhanced maintainer security (MFA/Hardware keys) and AI-aware package verification tools.