{
  "slug": "teampcp-supply-chain",
  "name": "TeamPCP supply-chain campaign",
  "aliases": [
    "Trivy",
    "KICS"
  ],
  "status": "dormant",
  "firstSeen": "2026-03-24",
  "lastSeen": "2026-03-24",
  "lastReviewed": "2026-09-20T00:00:00Z",
  "summary": "Poisoned LiteLLM releases harvested build and cloud secrets.",
  "description": "TeamPCP published poisoned LiteLLM 1.82.7 and 1.82.8 releases; the latter added a startup .pth payload.",
  "actor": "TeamPCP",
  "platforms": [
    "pypi",
    "github"
  ],
  "ttps": [
    {
      "framework": "atr",
      "id": "supply-chain"
    }
  ],
  "timeline": [
    {
      "date": "2026-03-24",
      "branch": "package",
      "id": "litellm@1.82.7",
      "note": "Poisoned PyPI release window.",
      "source": "https://securitylabs.datadoghq.com/articles/litellm-compromised-pypi-teampcp-supply-chain-campaign/"
    },
    {
      "date": "2026-03-24",
      "branch": "package",
      "id": "litellm@1.82.8",
      "note": "Startup .pth branch harvested credentials.",
      "source": "https://docs.litellm.ai/blog/security-update-march-2026"
    }
  ],
  "iocs": [
    {
      "type": "package",
      "value": "litellm@1.82.7",
      "firstSeen": "2026-03-24",
      "source": "https://securitylabs.datadoghq.com/articles/litellm-compromised-pypi-teampcp-supply-chain-campaign/"
    },
    {
      "type": "package",
      "value": "litellm@1.82.8",
      "firstSeen": "2026-03-24",
      "source": "https://securitylabs.datadoghq.com/articles/litellm-compromised-pypi-teampcp-supply-chain-campaign/"
    }
  ],
  "exposedConfigurations": [
    {
      "label": "LiteLLM 1.82.7 or 1.82.8 is installed",
      "matcher": {
        "some": "mcpServers",
        "where": {
          "all": [
            {
              "field": "package",
              "op": "eq",
              "value": "pkg:pypi/litellm"
            },
            {
              "field": "resolvedVersion",
              "op": "in",
              "value": [
                "1.82.7",
                "1.82.8"
              ]
            }
          ]
        }
      }
    }
  ],
  "advisories": [
    "ACVE-2026-0404"
  ],
  "incidents": [],
  "sources": [
    {
      "url": "https://securitylabs.datadoghq.com/articles/litellm-compromised-pypi-teampcp-supply-chain-campaign/",
      "publisher": "Datadog",
      "date": "2026-03-24"
    },
    {
      "url": "https://docs.litellm.ai/blog/security-update-march-2026",
      "publisher": "LiteLLM",
      "date": "2026-03-24"
    }
  ],
  "dormantAfterDays": 30
}