DEV Community
•
2026-04-06 18:30
How I Audited My Infra After the LiteLLM Supply Chain Attack (And What I'm Doing Differently Now)
I woke up to a Slack thread on March 24, 2026, that made my stomach drop. LiteLLM, the Python proxy I'd been running to route LLM calls across providers, had been backdoored with credential-stealing malware. Versions 1.82.7 and 1.82.8, published by a threat actor called TeamPCP, contained a three-stage payload that harvested SSH keys, cloud credentials, Kubernetes secrets, and cryptocurrency walle...
