95 Million Downloads Hijacked: The LiteLLM PyPI Backdoor Targeting AI Developers

A supply-chain compromise of the LiteLLM PyPI package (versions 1.82.7 and 1.82.8) delivered a multi-stage backdoor that executes on import and — via a .pth persistence file — on any Python invocation; the payload harvests credentials, targets Kubernetes clusters (deploying privileged pods), installs a systemd backdoor (sysmon.service), and exfiltrates encrypted data to attacker-controlled domains, and the activity is attributed to the threat actor "TeamPCP".