# Three’s a Crowd: TeamPCP trojanizes LiteLLM in Continuation of Campaign

TeamPCP trojanized LiteLLM PyPI packages 1.82.7/1.82.8, using a malicious .pth file to run a base64 payload that steals credentials and exfiltrates them.

- Payout: Real-world hack
- Severity: critical
- Program: LiteLLM
- Credited: Wiz Research
- Disclosed: 2026-03-24
- Write-up quality: 7/10
- Original: https://www.wiz.io/blog/threes-a-crowd-teampcp-trojanizes-litellm-in-continuation-of-campaign
- Library page: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-threes-a-crowd-teampcp-trojanizes-litellm-in-continuation-of-campaign
- Tags: domain:cloud domain:oss impact:data-leak impact:internal-access kind:incident platform:threat-intel sev:critical tech:python technique:source-review vuln:misconfiguration vuln:secrets-leak

**Target:** PyPI package litellm (Python library/proxy server)
**Root cause:** Attacker with a PyPI API token (exposed in prior Trivy incident) published malicious versions 1.82.7/1.82.8; 1.82.8 abuses Python's .pth initialization mechanism to execute a double base64-encoded payload on any interpreter start.
**Steps:**
1. Obtain PyPI API token exposed in prior Trivy compromise
2. Publish litellm 1.82.7 adding double base64 payload dropped to p.py, executed on `litellm --proxy` or import of `litellm.proxy.proxy_server`
3. Publish 1.82.8 adding `litellm_init.pth` that runs payload via subprocess on any python invocation
4. Payload harvests env vars, SSH keys, cloud creds, k8s configs, CI/CD secrets, Docker configs, DB creds, crypto wallets
5. Encrypt with AES-256, wrap key with embedded RSA public key, exfiltrate to checkmarx[.]zone / models[.]litellm[.]cloud
6. Install persistence via basic and Kubernetes mechanisms using checkmarx.zone/raw callout
**Exploitation:** Supply-chain compromise: malicious package versions installed by victims execute credential-stealing payload automatically on import or any Python process start, exfiltrating encrypted secrets to attacker domains.
**Escalation:** Persistence via .pth ensures execution across all Python processes; harvested cloud/k8s/CI credentials enable lateral movement.
**Insight:** A malicious .pth file in a wheel executes on every Python interpreter start regardless of import, so supply-chain audits should diff package contents for .pth files and pyproject.toml build hooks, not just import-time code.