Industry Newsllmpypilite llmsupply chain
LiteLLM Package Suffers Malicious PyPI Supply-Chain Compromise
9.1
Relevance Score
Security researchers reported on March 25, 2026 that the popular Python package LiteLLM was compromised on PyPI, with malicious code injected into versions 1.82.7 and 1.82.8 by threat actor TeamPCP. The library, used to route requests across LLM providers and claiming over 95 million monthly downloads, represents a high-impact supply-chain breach requiring immediate mitigation and audits.
Scoring Rationale
High urgency and widespread exposure drive score; limited corroboration outside single security outlet reduces certainty.
Sources
- Read OriginalCompromised LiteLLM Package With 95M Downloads Tied to TeamPCP, After Trivy & KICS Hacksitsecuritynews.info
