How LiteLLM Turned Developer Machines Into Credential Vaults for Attackers

In March 2026 the TeamPCP actor compromised LiteLLM packages on PyPI (versions 1.82.7 and 1.82.8), injecting infostealer malware that executed during installation and harvested SSH keys, cloud credentials (AWS, Azure, GCP), Docker configs, and other plaintext secrets from developer workstations; transitive dependencies amplified impact across many projects. The article details the attack mechanics and scope, cites prior large-scale credential-harvesting campaigns, and recommends mitigation measures including scanning developer endpoints (ggshield), moving secrets into vaults and ephemeral credentials, treating AI agents as sensitive stores, and deploying honeytokens and automated remediation to reduce exposure.