Criminals Poisoned a Python Package Downloaded 95 Million Times a Month. AI Developers Were the Target.
On 24 March 2026, attackers slipped malicious code into LiteLLM, a software tool used by AI developers worldwide. Three hours online was enough to reach tens of thousands of companies.
Key points
- On 24 March 2026, a criminal group called TeamPCP pushed malware-laced versions 1.82.7 and 1.82.8 of LiteLLM, a Python software package used by AI developers, to the official PyPI package registry.
- The poisoned versions were available for roughly three hours before being removed, but that was long enough to reach tens of thousands of corporate networks.
- The malware silently harvested cloud account passwords and keys for Amazon Web Services, Google Cloud, and Microsoft Azure without developers doing anything unusual.
- In late April 2026, a separate attack hit PyTorch Lightning versions 2.6.2 and 2.6.3, another widely used AI tool, with credential-stealing code.
- Security firm ReversingLabs reports that malicious open-source packages rose by 73 percent in 2026.
LiteLLM is a free software package, written in the Python programming language, that helps developers build applications powered by artificial intelligence. It gets downloaded roughly 95 million times a month. On 24 March 2026, anyone who updated or freshly installed the package may have quietly handed criminals the keys to their company's cloud accounts.
The group behind the attack, tracked publicly as TeamPCP, had already run similar operations against security tools from Aqua Security and Checkmarx before turning to AI infrastructure software. CSO Online first reported the broader campaign pattern.
How did the attackers get in?
TeamPCP stole the login credentials of the person responsible for publishing LiteLLM to PyPI, the Python Package Index, which is the central online store where developers download Python software. With those credentials in hand, they published two poisoned versions of the package as if they were routine updates.
The malicious code hid inside a .pth file, a little-known Python mechanism that runs code automatically every time Python starts up, before a developer even opens their project. No extra steps needed. No suspicious file to click. The code simply ran.
Its job was to steal cloud access tokens and secret keys for Amazon Web Services (AWS), Google Cloud Platform (GCP), and Microsoft Azure, along with SSH keys, which are digital passwords used to connect securely to remote servers.
Why are AI development environments a bigger risk?
A standard software attack might steal one database password. AI development environments are different. They sit at the intersection of cloud storage, automation pipelines, model training data, and production systems all at once. One infected package can expose all of it simultaneously.
There is a second problem that most security teams have not yet caught up with. When developers use AI coding assistants to write code, those tools often suggest specific packages to install. Researchers have identified a pattern called "slopsquatting": AI assistants sometimes invent package names that do not exist. Criminals can register those fake names first and wait for developers to install them. Across nearly 200,000 Python prompts tested, every major AI coding assistant produced at least some hallucinated package names, creating a permanent gap that no single software update can fix.
What should developers and security teams do right now?
Three practical controls reduce the risk significantly.
| Action | Why it matters |
|---|---|
Pin exact software versions (e.g. requests==2.31.0) |
Prevents automatic silent upgrades to malicious versions |
| Review post-install hooks before packages reach developer machines | The LiteLLM payload ran before any code was imported |
| Rotate all cloud credentials if pipelines pulled LiteLLM on 24 March | Stolen tokens enable movement across AWS, GCP, and Azure |
Tools like Socket and Sonatype can scan PyPI packages for suspicious behaviour before installation. Checking cloud provider audit logs for login activity from unexpected locations is a fast way to spot a stolen token already in use.
If your team installed LiteLLM on 24 March 2026, treat every cloud credential those machines could access as potentially stolen and replace them. Then check your logs.
Common questions
Does this affect ordinary computer users, or just developers?
Directly, it targets developers building AI software. Indirectly, if a developer at a company you use was affected and their cloud credentials were stolen, your data held by that company could be at risk.
How would a developer know if they installed the bad version?
Check whether LiteLLM version 1.82.7 or 1.82.8 appears in your project's dependency list. If it does, and it was installed on or around 24 March 2026, rotate all cloud credentials accessible from that machine immediately.
Can this happen again with other packages?
Yes. The 73 percent rise in malicious open-source packages in 2026 shows this is an active and growing method. Pinning exact software versions and scanning packages before installation are the two most effective habits to build now.
