LiteLLM — Supply-Chain Attack by TeamPCP Utilizing SANDCLOCK Backdoor (CVE-N/A)

Publication date: August 17, 2026
Category: Supply Chain Attacks

Introduction

Defensive security operations face a critical juncture following the discovery of a targeted attack against the artificial intelligence software supply chain. The threat actor group known as TeamPCP successfully compromised the maintainer credentials of the popular AI gateway LiteLLM, injecting malicious versions into the official Python Package Index (PyPI) repository. The integrated payload, identified by cybersecurity firm Resecurity as the SANDCLOCK trojan, operated covertly for several months, exposing cloud infrastructure credentials, version control tokens, and Large Language Model (LLM) provider keys across more than 2,500 global organizations, including highly regulated sectors such as banking, healthcare, and technology.

What is LiteLLM and the Attack Vector? (General Analysis)

LiteLLM is a widely adopted open-source utility library and gateway that unifies API calls for over 100 LLM providers, including OpenAI, Anthropic, Google Gemini, and local Ollama models. Its native integration into AI application development workflows makes it a core component of modern software architecture.

The compromise of such a critical component exponentially multiplies the blast radius. By infecting versions 1.82.7 and 1.82.8 published on PyPI around March 2026, the threat actors established a prolonged exposure window that severely strained key metrics such as Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR).

• Estimated CVSS Vector (Reasoned Estimation): 9.8 / 10 (Critical)
• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (Estimated based on the severity of remote code execution within the supply chain and mass credential theft).
• CWE Classification (Reasoned Estimation): CWE-506 (Embedded Malicious Code) and CWE-494 (Download of Code Without Integrity Check).

How Does It Work? (Technical Analysis)

The incident materialized through a direct intrusion into the accounts of the legitimate package maintainers, allowing the insertion of malicious code directly into the PyPI distribution artifacts.

• Initial Infection Flow / Exploit Entry:

  • Developers and CI/CD pipelines that automatically updated Python dependencies downloaded and installed the compromised versions (1.82.7 or 1.82.8).
  • During the initialization or execution phase of the trojanized package, the embedded SANDCLOCK backdoor payload silently deployed within the local execution environment or build server.

• Persistence and Secret Harvesting Mechanisms:

  • The malicious component systematically scanned the operating system environment for high-sensitivity credentials stored in environment variables, local configuration files, and secret stores.
  • Harvested items included GitHub App private keys, personal access tokens (PATs), AWS, GCP, and Firebase credentials, container registry tokens (ECR, JFrog), SSH keys, Kubernetes secrets, and corporate credentials linked to AI provider APIs.

• Data Exfiltration:

  • Resecurity identified a massive compressed archive of approximately 150 GB containing data stolen by the credential-stealing trojan, evidencing a structured, mass harvesting of CI/CD identities and corporate access vectors.

Affected Systems / Environments

The impact spans hundreds of thousands of continuous integration and continuous deployment (CI/CD) environments and over 2,500 organizations. Analyzed victim manifests enumerate 898 distinct compromised GitHub owners and organizations across 2,038 repositories.

• Vulnerable Versions: LiteLLM versions 1.82.7 and 1.82.8 (PyPI).
• Most Impacted Sectors: Technology, Banking & Finance, Healthcare, and major global enterprises.
• Notable Owners in Victim Manifests: Microsoft, Azure, IBM, NVIDIA, PayPal (Zettle), Deloitte, Bosch, S&P Global, Elevance Health, 84.51° (Kroger), Adeo (Leroy Merlin), Kärcher, Dräger, ID.me, 1inch, and Cencosud-Cencommerce (accounting for the highest volume of affected repositories, reaching 64).

Mitigation and Detection

Remediation

Organizations that have utilized or deployed LiteLLM in their environments during the exposure window must execute an immediate incident response plan:

1. Mass Credential Revocation and Rotation: Immediately invalidate all GitHub App private keys, PAT tokens, AWS/GCP/Firebase credentials, ECR/JFrog tokens, SSH keys, and code-signing passwords exposed across CI/CD environments.
2. Dependency Update: Force the update of the LiteLLM package to secure versions succeeding or preceding the compromise window, completely purging versions 1.82.7 and 1.82.8.
3. Session Invalidation: Terminate all active sessions across development platforms and associated language model provider accounts.

Detection

Defensive security teams (Blue Teams) must audit activity logs for suspicious artifacts and anomalous calls to AI services or cloud infrastructure originating from automated environments.

Analyst Warning: “The presence of LiteLLM versions 1.82.7 or 1.82.8 within any CI/CD pipeline must be treated as a total identity compromise. The default assumption must be that all operational keys accessible by those environments have been exfiltrated.”

• Recommended Indicators of Compromise (IoCs) for Threat Hunting:
  • Binary files or Python installation scripts referencing LiteLLM versions 1.82.7 and 1.82.8.
  • Unauthorized outbound traffic from build servers toward unknown infrastructure endpoints during build execution windows.

Wrapping Up

The LiteLLM supply-chain attack orchestrated by the TeamPCP group via the SANDCLOCK trojan demonstrates the structural vulnerability of modern development ecosystems reliant on open-source AI dependencies. With over 2,500 organizations affected and the mass extraction of 150 GB of corporate credentials, this incident underscores the urgent necessity to implement strict dependency integrity controls, continuous artifact scanning in public package repositories, and rapid automated secret rotation capabilities across cloud infrastructures and CI/CD pipelines.

References

• Resecurity. (2026). LiteLLM / TeamPCP Supply-Chain Attack Analysis. Resecurity Threat Intelligence Briefings.
• The Hacker News. (2026). LiteLLM Supply-Chain Attack – Technology, Banking and Healthcare the Most Affected. Retrieved from https://securityaffairs.com/?p=197377