Criminals Poisoned a Python Package Downloaded 95 Million Times a Month. AI Developers Were the Target.
On 24 March 2026, attackers slipped malicious code into LiteLLM, a software tool used by AI developers worldwide. Three hours online was enough to reach tens of thousands of companies.
Key points
- On 24 March 2026, a criminal group called TeamPCP pushed malware-laced versions 1.82.7 and 1.82.8 of LiteLLM, a Python software package used by AI developers, to the official PyPI package registry.
- The poisoned versions were live for roughly three hours before removal, long enough to hit tens of thousands of corporate networks.
- The malware silently harvested cloud account credentials and keys for Amazon Web Services, Google Cloud, and Microsoft Azure.
- In late April 2026, a separate attack hit PyTorch Lightning versions 2.6.2 and 2.6.3 with credential-stealing code.
- ReversingLabs reports malicious open-source packages rose 73 percent in 2026.
LiteLLM is a free Python package that helps developers build AI-powered applications. It's downloaded roughly 95 million times a month. On 24 March 2026, anyone who updated or installed the package may have quietly handed criminals access to their company's cloud accounts.
TeamPCP, the group behind the attack, had already run similar operations against security tools from Aqua Security and Checkmarx before turning to AI infrastructure software. Our earlier coverage traced the group's history back to 2020: "The hacking crew behind a big supply-chain attack has been busy since 2020".
How did the attackers get in?
TeamPCP stole the login credentials of the person responsible for publishing LiteLLM to PyPI, the Python Package Index, the central online store where developers download Python software. With those credentials, they published two poisoned versions as if they were routine updates.
The malicious code hid inside a .pth file, a little-known Python mechanism that runs code automatically every time Python starts, before a developer opens their project. It didn't need a suspicious file to click or any extra step from the user. The code simply ran, then collected cloud access tokens and secret keys for AWS, GCP, and Azure, along with SSH keys (digital credentials used to connect securely to remote servers).
Why are AI development environments a bigger risk?
A standard software attack might steal one database password. AI development environments are different: they combine cloud storage, automation, model training, and production systems inside a single workspace. One infected package can expose all of it at once.
There's a second problem most security teams haven't caught up with. When developers use AI coding assistants, those tools often suggest specific packages to install. Researchers have identified a pattern called "slopsquatting": AI assistants sometimes invent package names that don't exist on PyPI. Criminals register those fake names first and wait. Across nearly 200,000 Python prompts tested, every major AI coding assistant produced some hallucinated package names, creating a gap no single software update can close.
This isn't an isolated problem. We've covered the same dynamic playing out across registries: fake npm packages posed as Alibaba developer tools in August, using name-squatting to deliver remote-access malware.
What should developers and security teams do right now?
Three practical controls reduce exposure.
| Action | Why it matters |
|---|---|
Pin exact software versions (e.g. requests==2.31.0) |
Stops automatic silent upgrades to malicious versions |
| Review post-install hooks before packages reach developer machines | The LiteLLM payload ran before any code was imported |
| Rotate all cloud credentials if pipelines pulled LiteLLM on 24 March | Stolen tokens allow movement across AWS, GCP, and Azure |
Tools like Socket and Sonatype can scan PyPI packages for suspicious behaviour before installation. Checking cloud provider audit logs for logins from unexpected locations is a quick way to spot a stolen token already in use.
If your team installed LiteLLM on 24 March 2026, treat every cloud credential those machines could reach as potentially stolen and replace them. Then check your logs.
Common questions
Does this affect ordinary computer users, or just developers?
Directly, it targets developers building AI software. Indirectly, if a developer at a company you use was affected and their cloud credentials were stolen, your data held by that company could be at risk.
How would a developer know if they installed the bad version?
Check whether LiteLLM version 1.82.7 or 1.82.8 appears in your project's dependency list. If it does, and it was installed on or around 24 March 2026, rotate all cloud credentials accessible from that machine immediately.
Can this happen again with other packages?
Yes, and it already has. The 73 percent rise in malicious open-source packages in 2026 is the clearest signal that this is an active method with a growing practitioner base. Pinning exact software versions and scanning packages before installation are the two most effective habits to build now.
