Python Library Exploit Threatens Complete Machine Security

Developers and platform engineers should inspect their systems now. A popular Python library used for LLM tooling was published with malicious builds. The compromised packages were uploaded to PyPI on March 24, 2026.

What happened

The library, LiteLLM, has over 40,000 GitHub stars. It provides a unified interface to forward requests to OpenAI-compatible endpoints, Anthropic, Google and other providers.

PyPI versions 1.82.8 and 1.82.7 were tampered with. Version 1.82.8 contained a malicious .pth file named litellm_init.pth.

How the malicious file runs

The .pth file executes automatically at Python process startup. That means the payload can run without importing the package. Version 1.82.7 required an import to activate its payload.

Discovery and initial impact

FutureSearch first noticed the issue. A Cursor IDE MCP plugin pulled LiteLLM as a transitive dependency.

The compromised code triggered an exponential fork bomb. The host ran out of RAM, which revealed the behavior.

Attribution and wider campaign

Investigators found a commit message on a forked repository reading “teampcp owns BerriAI.”

That calling card links to TeamPCP, the actor behind recent supply-chain attacks. TeamPCP previously compromised Aqua Security’s Trivy on March 19. They also targeted Checkmarx’s KICS GitHub Action on March 23.

The LiteLLM malware shares encryption and exfiltration patterns with those incidents. The maintainer’s GitHub issue about the compromise, issue #24512, was closed as “not planned.”

Payload behavior and goals

Reporters and analysts describe the malicious code as a three-stage credential stealer. It harvests data, encrypts and exfiltrates, then attempts lateral movement.

• System information: hostname, whoami, uname -a, network routes.
• Environment variables: full printenv capture, including API keys.
• SSH artifacts: private keys, known_hosts, authorized_keys, SSH config.
• Git credentials: ~/.gitconfig and ~/.git-credentials files.
• AWS credentials and IMDS tokens.
• GCP service account tokens and application_default_credentials.json.
• Azure credentials under ~/.azure.
• Kubernetes configs and service account tokens.
• Docker credentials and kaniko config files.
• Package manager tokens and common config files like .npmrc and .netrc.
• Shell histories for bash, zsh and other shells.
• Cryptocurrency wallet files across major coin implementations.
• SSL/TLS private keys located in /etc/ssl/private and Let’s Encrypt files.
• CI/CD files and terraform.tfvars, plus pipeline configuration files.
• Database credential files and LDAP configs.
• Webhook URLs discovered by grepping environment and config files.

Stolen data is encrypted with a 4,096-bit RSA key and AES-256-CBC. The bundle is archived and sent to models.litellm[.]cloud.

The malware also tries to move laterally. It attempts to create privileged Alpine pods in the kube-system namespace. It installs a persistent backdoor at ~/.config/sysmon/sysmon.py. A systemd service configuration then polls a command-and-control server for follow-up payloads.

Immediate actions for affected users

Check installed versions immediately. Run pip show litellm and verify your version number.

• Uninstall the compromised package if installed.
• Clear your pip cache entirely.
• Search for ~/.config/sysmon/sysmon.py on affected machines.
• Inspect Kubernetes clusters for unauthorized kube-system pods.
• Rotate all exposed credentials and keys immediately.
• Rotate SSH keys, cloud tokens, database passwords and API keys.

Remember that a .pth file runs on every Python process. Shared environments and CI runners are at high risk.

Broader implications

This incident highlights the dangers of supply-chain compromise in Python tooling. A Python library exploit can undermine machine security across many systems.

LiteLLM is a transitive dependency for AI agents, MCP servers, and LLM orchestration tools. That means many projects could pull the package indirectly.

Locking and pinning dependencies helps. But those measures only work if they reference a known-good release. A compromised maintainer account can cascade through thousands of projects quickly.

At the time of reporting, PyPI appears to have locked the offending package. If you installed a compromised version during the window, perform the remediation steps immediately.

Filmogaz.com will continue to follow this developing story and report further technical findings and remediation guidance.