A hacker group called TeamPCP poisoned a vulnerability scanner, used it to steal a PyPI publishing token, and pushed two malicious versions of LiteLLM, the open-source AI gateway with 95 million monthly downloads. The packages were live for 40 minutes. In that window, 47,000 copies were downloaded, Mercor lost 4 terabytes of data, Meta suspended its contract with the $10 billion AI data startup, and a class-action lawsuit was filed. This is the anatomy of AI infrastructure's most consequential supply chain attack.

A hacker group called TeamPCP poisoned a vulnerability scanner, used it to steal a PyPI publishing token, and pushed two malicious versions of LiteLLM, the open-source AI gateway with 95 million monthly downloads. The packages were live for 40 minutes. In that window, 47,000 copies were downloaded, Mercor lost 4 terabytes of data, Meta suspended its contract with the $10 billion AI data startup, and a class-action lawsuit was filed. This is the anatomy of AI infrastructure's most consequential supply chain attack.

On March 24, a threat actor called TeamPCP pushed backdoored versions of LiteLLM to PyPI, embedding a three-stage credential stealer that harvested SSH keys, cloud tokens, and Kubernetes secrets from every environment where the package was installed. LiteLLM sits in the dependency chain of nearly every major AI agent framework, and Wiz estimates it is present in 36% of all cloud environments. The attack is part of a broader campaign that has already hit Trivy, Checkmarx, and multiple package registries, with TeamPCP now claiming collaboration with the extortion group LAPSUS$.

On March 24, a threat actor called TeamPCP pushed backdoored versions of LiteLLM to PyPI, embedding a three-stage credential stealer that harvested SSH keys, cloud tokens, and Kubernetes secrets from every environment where the package was installed. LiteLLM sits in the dependency chain of nearly every major AI agent framework, and Wiz estimates it is present in 36% of all cloud environments. The attack is part of a broader campaign that has already hit Trivy, Checkmarx, and multiple package registries, with TeamPCP now claiming collaboration with the extortion group LAPSUS$.