TeamPCP Backdoors LiteLLM Versions 1.82.7–1.82.8 Likely via Trivy CI/CD Compromise

TeamPCP compromised litellm Python package versions 1.82.7 and 1.82.8 by exploiting the package's use of Trivy in its CI/CD pipeline, embedding a three-stage malicious payload.

• •The payload deploys a credential harvester targeting SSH keys, cloud credentials, Kubernetes secrets, cryptocurrency wallets, and .env files
• •A Kubernetes lateral movement toolkit uses the service account token to enumerate cluster nodes and deploy privileged pods to each
• •A persistent systemd backdoor (sysmon.service) polls checkmarx[.]zone/raw every 50 minutes for next-stage payloads, with a YouTube URL kill switch
• •Version 1.82.8 added a malicious litellm_init.pth file that triggers execution on every Python process startup, not just on litellm import
• •