LiteLLM Supply Chain Attack Explained: How TeamPCP Poisoned 95 Million Downloads and Exposed the AI Industry

Mercor Data Breach: The $10 Billion AI Startup Security Incident

Updated April 3, 2026 | Cybersecurity & AI Infrastructure

You’ve heard about the Mercor breach. But if you really want to understand what happened and, more importantly, whether your systems are exposed, you need to zoom in on the actual mechanism.

The Mercor data breach didn’t start at Mercor. It started weeks earlier, with a security scanner. And understanding that the chain is the difference between genuinely fixing the problem and just hoping for the best.

What Is LiteLLM, and Why Should You Care?

LiteLLM is an open-source Python library and proxy server that acts as a universal translator for AI applications. Instead of writing custom integration code for OpenAI’s API, then rewriting it for Anthropic’s API, then rewriting it again for Amazon Bedrock or Google Vertex AI, developers use LiteLLM to route all their LLM requests through a single, standardized interface that supports over 100 different providers.

It’s enormously popular for exactly that reason. According to security firm Snyk, LiteLLM is downloaded roughly 3.4 million times per day, and Wiz found it present in approximately 36% of all cloud environments they monitor. For AI startups and developer teams, it’s become essential plumbing.

That ubiquity is precisely what made it a target.

“LiteLLM is the backbone of modern AI infrastructure, acting as a universal proxy for LLM APIs,” wrote security researcher Igor Lasic. “Its popularity makes it an ideal ‘infection hub.'” Because LiteLLM typically sits between applications and multiple AI service providers, it has access to API keys, environment variables, and sensitive configuration data by design. Compromise it, and you don’t need to breach each downstream organization individually. You get handed the keys.

The Attack Chain: Five Ecosystems in Five Days

To understand the LiteLLM compromise, you need to follow TeamPCP’s campaign from its actual starting point. This was not a single attack. It was a cascading operation across five developer ecosystems: GitHub Actions, Docker Hub, npm, OpenVSX, and PyPI executed over roughly five days.

Phase 1: Trivy (March 19, 2026)

Trivy is an open-source vulnerability scanning tool made by Aqua Security. It’s widely used in CI/CD pipelines, the automated build-and-deploy systems that turn code into running software. Because it runs inside build pipelines with access to secrets and credentials, it’s exactly the kind of privileged tool that makes a juicy target.

On March 19, 2026, TeamPCP compromised Trivy’s GitHub Actions workflows and Docker images, injecting malware with a CVSS4B score of 9.4 (CVE-2026-33634). According to Kaspersky’s analysis, the attackers forcibly overrode 76 of 77 version tags in the aquasecurity/trivy-action repository, redirecting existing trusted versions to malicious commits. Every automated security scan using compromised Trivy versions began harvesting SSH keys, cloud tokens, cryptocurrency wallets, and other credentials from affected systems.

Aqua detected the attack that day and removed malicious artifacts. Then came the critical mistake: credential rotation was performed, but not atomically. Different credentials were rotated at different times, leaving a window during which an old token remained valid. TeamPCP used it.

Phase 2: Checkmarx KICS (March 23, 2026)

Four days later, using the same attack infrastructure, TeamPCP hit Checkmarx’s KICS (Keep Infrastructure as Code Secure) tool and related GitHub Actions. They even registered checkmarx.zone as a lookalike command-and-control domain. The malicious code was removed within three hours, but the pattern was now clear: each compromised environment yielded credentials that unlocked the next target.

Phase 3: LiteLLM on PyPI (March 24, 2026)

This is where things hit critical mass.

LiteLLM’s build pipeline used Trivy as part of its CI/CD process. Crucially, it pulled Trivy from apt without a pinned version, meaning it automatically fetched whatever was current, including the malicious build. The compromised Trivy action stole LiteLLM’s PyPI publishing token from the GitHub Actions runner environment.

At 10:39 UTC on March 24, 2026, version 1.82.7 of LiteLLM appeared on PyPI. Version 1.82.8 followed at 10:52 UTC. Neither existed in the official GitHub repository; they were published directly to PyPI using the stolen token, bypassing the normal release process entirely.

The Malware: What Versions 1.82.7 and 1.82.8 Actually Did

This is the part that security teams need to understand in technical detail, because the indicators of compromise and remediation steps depend on it.

Version 1.82.7: The Credential Harvester

In 1.82.7, TeamPCP inserted 12 malicious lines of code at line 128 litellm/proxy/proxy_server.py, tucked between two unrelated legitimate code blocks. According to Endor Labs’ analysis, the GitHub source at the corresponding commit doesn’t contain these lines; the injection happened during or after the wheel build process, which is why standard source code review wouldn’t have caught it.

When LiteLLM’s proxy server ran (via litellm –proxy or importing litellm. proxy.proxy_server. The payload was activated. It launched a multi-stage attack:

Stage 1 – Collection: A Python script scanned the host for sensitive files, including SSH private keys and configs. .env files, AWS/GCP/Azure credentials, Kubernetes configs, database passwords, and .gitconfig data.

Stage 2 – Exfiltration: Collected data was encrypted with a hardcoded 4,096-bit RSA public key using AES-256-CBC (random session key, encrypted with the RSA key), bundled into a tar archive, and sent via HTTP POST to https://models.litellm.cloud/ – a domain that looks convincingly like legitimate LiteLLM infrastructure.

Stage 3 – Lateral Movement: If a Kubernetes service account token was present, the malware read all cluster secrets across all namespaces and attempted to create privileged alpine:latest pods on every node in kube-system. Each pod mounted the host filesystem and installed a persistent backdoor /root/.config/sysmon/sysmon.py with a systemd user service.

Version 1.82.8: The Persistent Threat

Version 1.82.8 contained everything from 1.82.7 and added a second, more dangerous mechanism.

According to Wiz’s technical analysis, 1.82.8 included a malicious file called litellm_init.pth that abused Python’s .pth file mechanism. The .pth The mechanism allows code to run during Python interpreter initialization before any specific module is imported. This means the payload fired on every Python process startup in any environment where LiteLLM was installed, regardless of whether the developer was using LiteLLM at all.

A test runner. A utility script. Any Python process. All would silently trigger the credential harvester in the background.

Callum McMahon at FutureSearch, who first discovered and publicly disclosed the attack, noted that a bug in 1.82.8 actually caused it to create an exponential fork bomb. The .pth launcher spawned a child Python process, which triggered it .pth again, which spawned another child, multiplying exponentially until the machine crashed. The fork bomb was a defect in the malware, not a feature. But it was effectively how some organizations detected the compromise in the first place: their machines crashed.

The malicious versions were available for approximately three to five hours before PyPI quarantined them. In that window, they were downloaded over 40,000 times.

How Mercor Got Caught in the Blast Radius

Mercor’s infrastructure relied on LiteLLM. This is entirely unsurprising for a company that manages AI training data workflows and interfaces with multiple AI service providers simultaneously. LiteLLM is exactly the tool such an organization would use.

When the malicious LiteLLM versions ran in Mercor’s environment, the credential harvester would have had access to a particularly valuable set of secrets: API keys for OpenAI, Anthropic, and other AI providers; internal service credentials; and potentially configuration data related to Mercor’s own infrastructure and the training datasets it manages.

Mercor detected anomalous activity on April 28, 2025. By April 29, Lapsus$ had claimed responsibility publicly. The claimed haul: four terabytes of data, including a 200GB+ database, a 3TB drive of video and verification data, 939GB of source code, and all data from Mercor’s TailScale VPN account.

How exactly Lapsus$ obtained this data from a TeamPCP-originated credential harvest is not fully clear. TeamPCP had publicly stated its intention to partner with extortion groups. Whether the handoff of Mercor-specific data to Lapsus$ was part of that arrangement, or whether Lapsus$ independently exploited credentials obtained from the LiteLLM compromise, remains under investigation.

Indicators of Compromise (IOCs) and Detection

If you’re a security engineer trying to assess your own exposure, here are the key artifacts to look for:

Malicious domains used for C2:

• models.litellm.cloud (exfiltration endpoint)
• checkmarx.zone (earlier campaign infrastructure)
• scan.aquasecurtiy.org (note the deliberate typo aquasecurity vs. aquasecurity)

File system artifacts:

• ~/.config/sysmon/sysmon.py (persistence backdoor)
• ~/.config/systemd/user/sysmon.service (systemd persistence)
• litellm_init.pth in any environment where Litellm 1.82.8 was installed
• p.py dropped to disk (1.82.7 payload staging)

Kubernetes artifacts:

• Pods matching node-setup-* in kube-system
• Unauthorized access to cluster secrets across namespaces

Python package indicators:

• pip show litellm returning version 1.82.7 or 1.82.8
• find ~/.cache/uv -name "litellm_init.pth" returning results
• Any litellm wheel not matching the clean 1.82.6 build hash

Network indicators:

• Outbound HTTP POST to models.litellm.cloud
• Traffic to the C2 server IP 83.142.209.203

Remediation Steps: What to Do If You Were Exposed

The Python Packaging Authority (PyPA) issued an advisory stating that anyone who installed and ran the compromised versions should assume any credentials accessible to the LiteLLM environment were exposed. Here is the remediation checklist:

Step 1: Remove and purge the malicious package. Run pip uninstall litellm and then purge your package manager cache with rm -rf ~/.cache/uv or pip cache purge to prevent re-installation from cached wheels. Downgrade to version 1.82.6, which Endor Labs confirmed as the last clean release.

Step 2: Check for persistence mechanisms. Look for ~/.config/sysmon/sysmon.py and ~/.config/systemd/user/sysmon.service. If found, delete them and check whether any systemd services reference these paths.

Step 3: Rotate all credentials. Treat as compromised: SSH keys, AWS access keys and IAM tokens, GCP Application Default Credentials, Azure tokens, Kubernetes kubeconfigs, API keys in any .env files in the affected environment, database passwords, and any other secrets stored as environment variables.

Step 4: Audit Kubernetes. If running Kubernetes, audit kube-system for unauthorized pods. Review cluster-level secrets for any unauthorized reads. Check for service account tokens that may have been used to create pods or access secrets outside expected patterns.

Step 5: Review CI/CD pipelines. Audit your GitHub Actions workflows for any references to Trivy versions that may have been compromised. Implement pinned SHA hashes for all action references rather than floating version tags. Review pipeline execution logs from March 19 onward for any unexpected network activity.

Step 6: Pin all dependencies. Going forward, all production dependencies should be pinned to specific, verified hashes, not just version numbers. Implement Software Bill of Materials (SBOM) practices to maintain visibility into what’s actually running in your environments.

Why This Attack Was So Hard to Catch

Standard security practices failed here, and it’s worth being honest about why.

Code review wouldn’t have helped. The malicious code wasn’t in the GitHub repository; it was injected during or after the build process. Reviewing the source code would have shown nothing wrong.

Version pinning to a number wouldn’t have helped. If you pinned 1.82.7 specifically, you were pinning to the malicious version. Only hash-pinning would have protected you.

Vulnerability scanners wouldn’t have helped (in the short window). The malicious versions were only available for three to five hours before PyPI quarantined them. Most vulnerability databases hadn’t yet registered the threat.

What would have helped: behavioral monitoring. The anomalous outbound connections to models.litellm.cloud, the credential file access patterns, the attempt to create Kubernetes pods in kube-system These are all behavioral signals that security tooling like Wiz and Snyk can detect even when the malicious package hasn’t been catalogued yet.

This is the shift that the incident demands: from signature-based detection (“is this a known bad package?”) to behavioral detection (“is this package doing something unexpected?”). The former has a structural lag. The latter doesn’t.

The Cascading Logic: Why TeamPCP Targeted Security Tools Specifically

This is the insight that most coverage misses.

TeamPCP didn’t randomly select LiteLLM. They targeted it because of a deliberate strategic logic: security-adjacent tools run with elevated privileges. They have to run with elevated privileges to do their jobs. A vulnerability scanner that can’t read your infrastructure secrets isn’t a very good vulnerability scanner.

Krell, a researcher whose analysis was reported by ReversingLabs, described it precisely: “TeamPCP has exclusively targeted security-adjacent tools. A vulnerability scanner, an infrastructure as code analyzer, and now an LLM proxy that handles API keys by design. These tools run with broad access because that is how they function. Compromising one hands the attacker every credential and secret that tool was trusted to touch.”

Trivy had to be able to scan cloud environments, so it had cloud credentials. LiteLLM had to route requests to OpenAI and Anthropic, so it had API keys for both. Checkmarx’s tools had to analyze code infrastructure,e so they had access to CI/CD secrets.

Each compromise was a skeleton key. And each skeleton key opened the door to the next target.

Wiz’s Gal Nagli called it a loop: “Trivy gets compromised → LiteLLM gets compromised → credentials from tens of thousands of environments end up in attacker hands → and those credentials lead to the next compromise. We are stuck in a loop.”

Breaking that loop requires treating the trust model of security tooling as a first-class security problem, not an afterthought.

The AI-Powered Attacker: A New Dimension

Here’s a detail that got less attention than it deserves.

Wiz’s analysis found that TeamPCP’s campaign included a component called hackerbot-claw that uses an AI agent (called openclaw) for automated attack targeting. When the community began reporting the LiteLLM compromise in GitHub issue #24512, the attackers responded with 88 bot comments from 73 unique accounts in a 102-second window. The accounts were previously compromised developer accounts, and 76% overlapped with the botnet used during the Trivy disclosure.

This is one of the first documented cases of an AI agent being used operationally in a supply-chain attack campaign. The implication is uncomfortable: the same AI tooling that developers are racing to build is being weaponized by attackers to automate the discovery, targeting, and response-suppression phases of sophisticated supply-chain operations.

The AI security arms race isn’t coming. It’s here.

What This Means for the Open-Source Ecosystem

The scale of the problem has to be stated plainly: LiteLLM has 95 million monthly downloads. At the time of the compromise, it was present in 36% of cloud environments. The malicious versions were available for three to five hours and downloaded over 40,000 times.

Nobody knows exactly how many organizations were exposed. The compromised credentials weren’t all used immediately; some may be sitting in attacker archives, waiting for the right opportunity. TeamPCPs’ stated strategy of partnering with ransomware and extortion groups to systematically target exposed organizations means the full scope of damage may not be visible for months.

For the broader open-source ecosystem, this incident joins a growing list of SolarWinds, XZ Utils, the npm event-stream package, and PyPI typosquatting campaigns that collectively demonstrate a structural vulnerability in how software is built and distributed. The Python Packaging Authority has issued advisories. The FBI has warned of coming breach disclosures. The security community has published detailed IOCs and remediation guidance.

What hasn’t happened yet is the structural investment needed to make these attacks significantly harder. Open-source security needs dedicated funding, better tooling for detecting build-time injections, and standardized practices for supply chain integrity verification. The technology exists in Sigstore, the LSA framework, SBOM standards, and reproducible builds, but adoption has been slow relative to the threat.

The Mercor breach and the LiteLLM compromise that enabled it should change the calculus. The cost of inadequate supply-chain security is no longer theoretical. It’s four terabytes of the AI industry’s most sensitive data on a hacking forum.

Summary: The Attack Chain at a Glance

February 28: TeamPCP exploits a workflow vulnerability in Trivy, steals credentials.

March 19: TeamPCP injects malware into Trivy GitHub Actions and Docker images (CVE-2026-33634, CVSS 9.4). Aqua Security responds but rotates credentials non-atomically.

March 23: TeamPCP uses residual access from Trivy to hit Checkmarx KICS and related GitHub Actions. Registers checkmarx.zone as C2 infrastructure.

March 24, 10:39 UTC: Using LiteLLM’s stolen PyPI token (obtained via Trivy in LiteLLM’s CI/CD pipeline), TeamPCP publishes LiteLLM 1.82,7 a credential-harvesting backdoor.

March 24, 10:52 UTC: TeamPCP publishes LiteLLM 1.82, an even more aggressive version with Python .pth persistence.

March 24, ~15:00 UTC: PyPI quarantines the malicious versions. Over 40,000 downloads have already occurred.

April 28: Mercor detects anomalous activity in its systems.

April 29: Lapsus$ claims responsibility for targeting Mercor, publishes sample data to its leak site.

April 2-3, 2026: Mercor confirms the incident publicly. Fortune, TechCrunch, Cybernews, and others cover the breach. Industry response accelerates.