LiteLLM compromised on PyPI: Tracing the March 2026 TeamPCP supply chain campaign (opens in new tab)

Covered by 5 sources including Andrew Nesbitt, datadoghq.comDiscussed on Hacker News

On March 24, 2026, two PyPI releases of LiteLLM were published with malicious code. We trace the full TeamPCP supply chain campaign from Trivy through npm, Checkmarx, and into LiteLLM.

Read the original article

Sign in to keep reading the full article.

Sign Up Log In

Covered in 5 articles

Andrew Nesbitt·

GitHub Actions security in Python packages

datadoghq.com·

From single pull requests to full software packages: Detecting malicious code at scale

venturebeat.com·

Four AI supply-chain attacks in 50 days exposed the release pipeline red teams aren't covering

View all 5 ›