TeamPCP Hijacks LiteLLM's PyPI Package

TeamPCP hijacked the LiteLLM maintainer's PyPI account and published malicious litellm versions (1.82.7 and 1.82.8) that deploy a .pth auto-executing credential stealer and backdoors; the malware harvests cloud, developer, CI/CD, and crypto credentials, attempts Kubernetes cluster takeover, exfiltrates encrypted bundles to models.litellm.cloud, and installs persistent sysmon backdoors (beaconing to checkmarx.zone). PyPI quarantined the project and the report provides IOCs, persistence indicators, attack timeline, links to prior TeamPCP activity, and remediation guidance (credential rotation, CI audits, pinning actions, 2FA).