TeamPCP Compromises LiteLLM: 434,000 Pipelines Exposed in 40…

TeamPCP injected malicious LiteLLM packages onto PyPI for 40 minutes. CloudSEK estimates 2,500+ organizations exposed. Stolen credentials persist months later.

The threat actor group TeamPCP compromised the LiteLLM CI pipeline in March 2026, injecting malicious versions of the popular Python proxy server via a compromised Trivy scanner. The exposure window on PyPI lasted approximately 40 minutes, according to CloudSEK, the cybersecurity vendor that publicly disclosed the incident on August 11, 2026. The estimated scope — 2,500+ organizations and 434,000 potentially exposed CI/CD pipelines — illustrates how modern supply-chain automation has compressed propagation time to zero: what once took days now happens in the time of a commit.

Key Takeaways

TeamPCP compromised the Trivy scanner in the LiteLLM CI pipeline for roughly 20 days, exploiting an unrevoked token to inject the payload into the build system
Malicious versions 1.82.7 and 1.82.8 were published to PyPI for approximately 40 minutes; the payload used .pth files for automatic execution on Python startup
The SANDCLOCK malware, tracked by Google, harvested cloud credentials, AI provider keys, Kubernetes tokens, and CI/CD secrets from /proc/<pid>/mem
CloudSEK's estimates describe reconstructed exposure, not confirmed compromise: the 2,500+ companies and 434,000 pipelines are potentially at risk, not verifiably breached

From Trivy to PyPI: The Cascading Chain

The attack followed a chain of three linked compromises, as reconstructed by CloudSEK. The initial vector was an unrevoked CI account token that allowed TeamPCP to compromise the Trivy scanner — a vulnerability scanning tool widely used in pipelines — for roughly 20 days. From there, the LiteLLM build system automatically installed the corrupted scanner version, enabling payload injection into the project's releases.

The result: Python package versions 1.82.7 and 1.82.8, available on PyPI for approximately 40 minutes before removal. The payload used .pth files — a Python initialization mechanism that executes code automatically on interpreter startup without requiring explicit import — to activate the SANDCLOCK malware on systems that installed or updated LiteLLM during that window.

"Trivy, then the [LiteLLM] build system, then the LiteLLM release: one unrevoked token, three tools deep. That chain is what turns a single credential leak into ecosystem-wide exposure." — CloudSEK

SANDCLOCK: The Infostealer That Reads Process Memory

Once active, SANDCLOCK escalated to root privileges and harvested credentials directly from process memory, including values that GitHub Actions attempts to mask, extracting them from /proc/<pid>/mem. The malware was configured to collect AWS, GCP, and Azure keys, Kubernetes tokens, package publishing credentials, SSH keys, and AI and LLM provider API keys.

Exfiltration used AES-256 encryption under a hardcoded RSA-4096 key, directed to a typosquatted domain. If communication failed, the malware created a public repository inside the victim's GitHub account and uploaded stolen data as release assets — a technique that leverages the victim's own infrastructure to bypass egress controls.

The process-memory collection method is particularly relevant for CI/CD pipelines: secrets injected as environment variables, even those marked as masked by orchestration systems, remain readable in the memory space of the process that uses them. SANDCLOCK exploited precisely this architectural characteristic.

The Exposure Dataset: Numbers and Organizations

CloudSEK reconstructed an exposure dataset that includes high-profile enterprise names: AWS, Samsung, Cisco, ServiceNow, S&P Global, X Corp, Zscaler, NVIDIA, Salesforce, Volkswagen, Orange, Thales, LSEG, Roche, Airbus, Siemens, Vodafone, Epic Games, Krungthai Bank. For some, the report cites specific quantitative data: Cisco with 327 secrets and 1,900 runs; S&P Global with 1,218 secrets and 1,108 runs; X Corp with 3,459 secrets and 1,153 runs; Orange with 180 secrets and 5,642 runs.

CloudSEK explicitly qualified these figures: "The 2,500+ company and 434,000 pipeline figures describe reconstructed exposure. They should not be read as proof that every listed organization was successfully compromised or that every credential was stolen." Attribution to TeamPCP is reconstructed by CloudSEK, without independent confirmation from available sources.

The FBI issued a FLASH advisory (FLASH-20260702-01) in July 2026, according to CloudSEK, warning that actors affiliated with TeamPCP are likely capable of weaponizing the harvested credentials. This detail is not independently verifiable from sources in the dossier.

Forty Minutes, Five Months of Persistence

The incident's structure reveals a pattern that distinguishes modern supply-chain attacks from traditional worms like Conficker or Slammer. Where 2000s-era worms were noisy, detectable, and scaled in real time, the LiteLLM compromise was silent, contained in a 40-minute window, and produced a payload — valid credentials — that persists as risk for months.

"Forty minutes was the theft. Five months later, the FBI is still warning that the stolen credentials will be weaponized." — Jacob Krell, Suzu Labs

As Seemant Sehgal of BreachLock noted: "The malicious packages were live for 40 minutes, but the window mattered to defenders long after it mattered to the attacker." CI/CD automation eliminated reaction time: pipelines that depend on automatic installations consumed the malicious package before any human process could intervene. The harvested credentials, if not rotated, remain valid regardless of package removal.

Why It Matters

The dossier does not specify corrective measures indicated by the primary source. CloudSEK did not release detailed operational guidance in the available technical report, and secondary sources do not add independently verifiable mitigation checklists.

The source does not specify whether organizations listed in the dataset received direct notification, nor does it document a coordination process with involved security vendors. The brief does not list patch management, automatic credential rotation, or specific monitoring as actions recommended by the source itself.

The dossier does not clarify the exact timeline of the initial Trivy attack (March 2026 is indicative), nor does it provide the actual number of organizations truly compromised versus those exposed. No infrastructure overlaps linking TeamPCP to other threat actor groups emerge at this time. The extent of economic losses or concrete damages is not documented.

The Real Perimeter Has Become AI Infrastructure

The LiteLLM incident is not a compromise of an LLM model, but of the infrastructure that serves it. LLM gateways, MCP servers, and provider keys have become high-value targets not for the data they directly contain, but for the access they unlock: cloud, sensitive data, automated action systems. The Trivy → build → PyPI chain shows how AI infrastructure security depends on the security of the toolchain three degrees prior.

The distinction between exposure and actual compromise is the central methodological limit of this report. CloudSEK reconstructed the attack surface, not verified impact. For organizations in the dataset, this means risk must be verified internally, not assumed or dismissed based on external estimates.

FAQ

What is the difference between exposure and confirmed compromise?

The CloudSEK dataset reconstructs which pipelines could have downloaded the malicious versions, not which actually did or which credentials were actually exfiltrated. The figures of 2,500+ organizations and 434,000 pipelines describe potential exposure, not verified compromise.

Why were 40 minutes on PyPI sufficient?

Automated CI/CD pipelines install dependencies without human intervention. A 40-minute window fully covers the automatic build cycles of many organizations. Rapid package removal does not undo installations that already occurred.

What do we know about attribution to TeamPCP?

Attribution to the TeamPCP group is reconstructed by CloudSEK in its technical report. No independent confirmations from multiple primary sources emerge in the available dossier.

Sources

Information is based on cited sources and current as of publication.

Sources

Sources and references