# How a Poisoned Security Scanner Became the Key to Backdooring LiteLLM

DevFeed: [How a Poisoned Security Scanner Became the Key to Backdooring LiteLLM](<https://devfeed.tech/articles/how-a-poisoned-security-scanner-became-the-key-to-backdooring-litellm-8045.md>)

Original publisher: [Read original article](<https://snyk.io/blog/poisoned-security-scanner-backdooring-litellm/>)

Author: Stephen Thoemmes

Published: 2026-03-24T04:00:00Z

Content type: news

Language: en

Sources: [Blog RSS Feed | Snyk](<https://devfeed.tech/sources/blog-rss-feed-snyk.md>)

Topics: [open-source-security](<https://devfeed.tech/topics/open-source-security.md>), [CI/CD](<https://devfeed.tech/topics/cicd.md>), [incident](<https://devfeed.tech/topics/incident.md>), [Processes](<https://devfeed.tech/topics/processes.md>), [cursor](<https://devfeed.tech/topics/cursor.md>)

Tags: [ai](<https://devfeed.tech/tags/ai.md>), [application-security](<https://devfeed.tech/tags/application-security.md>), [aspm](<https://devfeed.tech/tags/aspm.md>), [awareness](<https://devfeed.tech/tags/awareness.md>), [blog](<https://devfeed.tech/tags/blog.md>), [ci-cd](<https://devfeed.tech/tags/ci-cd.md>), [cloud-security](<https://devfeed.tech/tags/cloud-security.md>), [code-security](<https://devfeed.tech/tags/code-security.md>), [container-security](<https://devfeed.tech/tags/container-security.md>), [developer](<https://devfeed.tech/tags/developer.md>), [devops](<https://devfeed.tech/tags/devops.md>), [devsecops](<https://devfeed.tech/tags/devsecops.md>), [docker](<https://devfeed.tech/tags/docker.md>), [github-actions](<https://devfeed.tech/tags/github-actions.md>), [incident](<https://devfeed.tech/tags/incident.md>), [kubernetes](<https://devfeed.tech/tags/kubernetes.md>), [malware](<https://devfeed.tech/tags/malware.md>), [open-source-security](<https://devfeed.tech/tags/open-source-security.md>), [python](<https://devfeed.tech/tags/python.md>), [secrets](<https://devfeed.tech/tags/secrets.md>), [security](<https://devfeed.tech/tags/security.md>), [supply-chain](<https://devfeed.tech/tags/supply-chain.md>), [supply-chain-security](<https://devfeed.tech/tags/supply-chain-security.md>), [teampcp](<https://devfeed.tech/tags/teampcp.md>), [vulnerability-insights](<https://devfeed.tech/tags/vulnerability-insights.md>)

## AI overview

Snyk reports that compromised Trivy GitHub Action credentials enabled TeamPCP to publish malicious LiteLLM package versions 1.82.7 and 1.82.8 to PyPI. The payload ran at Python startup and recursively spawned subprocesses, causing unintended RAM exhaustion and a fork bomb.

## Source excerpt

On March 24, 2026, threat actor known as TeamPCP published backdoored versions of the litellm Python package after stealing PyPI credentials via a compromised Trivy GitHub Action in LiteLLM's CI/CD pipeline. Here's what happened, how the three-stage malware works, and how to check if you're affected.