3 days ago, litellm 1.82.8 hit PyPI. 3 hours later it was gone. But not before infecting unknown numbers of CI/CD pipelines, developer machines, and cloud environments.
litellm between March 24–27, 2026, assume compromise and rotate all credentials accessible from that machine — SSH keys, AWS/GCP tokens, crypto wallets, Slack, Discord, .env files.
On March 24, 2026, a threat group called TeamPCP published two malicious versions of litellm — one of the most popular AI tooling packages in the Python ecosystem. LiteLLM has 3.4 million daily downloads. It's in the dependency tree of virtually every serious AI agent project.
The attack didn't use a zero-day. It used something far simpler: a .pth file.
When Python starts, it reads every .pth file in your site-packages directory. If the file contains an import statement, Python executes it — silently, before your code runs.
TeamPCP used this to plant a three-stage credential stealer:
Python starts
→ reads site-packages/litellm.pth
→ executes base64-decoded payload
→ exfiltrates: SSH keys, AWS/GCP tokens, crypto wallets,
Slack tokens, Discord tokens, .env filesNo prompts. No warnings. No logs.
This wasn't one attack. It was a coordinated supply chain operation:
| Date | Target | Impact |
|---|---|---|
| Mar 19 | aquasecurity/trivy-action | 76 GitHub Action tags poisoned, 1,000+ cloud envs infected |
| Mar 20 | 66+ npm packages | CanisterWorm self-spreading worm with blockchain C2 |
| Mar 23 | Checkmarx GitHub Actions | Compromised via stolen Trivy CI/CD credentials |
| Mar 24 | litellm 1.82.7, 1.82.8 | 3.4M daily downloads, .pth credential stealer |
| Mar 27 | telnyx 4.87.1, 4.87.2 | WAV steganography payload, AES-256-CBC exfil (CVE-2026-33634) |
Each attack used credentials stolen from the previous one. Trivy was the entry point. LiteLLM was the payload.
Your usual defenses weren't designed for this:
The attack window was 3 hours. Standard tooling has a 24–48 hour lag minimum.
CodeGuard Pro is a pre-install security gate. It runs before pip, not after.
Safe packages pass cleanly:
Compromised packages — a curated database of known-malicious versions, updated as attacks are discovered. Currently includes litellm, telnyx, ultralytics YOLO, ctx, and more.
GitHub Actions supply chain attacks — scans your .github/workflows/ for mutable tag references and known-compromised actions (tj-actions/changed-files CVE-2025-30066, Trivy-action TeamPCP poisoning, Checkmarx).
.pth file injection — detects malicious .pth files in your Python environment that execute code at startup.
Typosquatting — catches packages named to look like popular ones (requestss, pandas-sdk, colorinal).
Secret scanning — 25+ patterns: OpenAI, AWS, Stripe, GitHub, Slack, GCP, private keys, JWTs.
6 real attack techniques: base64-obfuscated eval, socket exfiltration, subprocess curl to attacker C2, requests.post of environment variables, WAV steganography decoding. All 6 blocked. Safe packages pass.
CodeGuard started as a simple secret scanner for AI coding agents. Over the last week it evolved fast:
The threat feed is the key piece. Instead of baking IOCs into the binary, there's a hosted feed that updates in real time as new attacks are discovered — without requiring users to reinstall.
The timing of this attack is not coincidental. AI coding agents are writing and installing packages faster than any human review process can keep up with. Cursor, Claude Code, Codex — they all install dependencies on your behalf. None of them, by default, check whether the version they're about to install was compromised 3 hours ago.
CodeGuard closes that gap.