Supply Chain Risks in AI Development

On March 24, 2026, developers utilizing LiteLLM, a Python package characterized by 95 million monthly downloads, encountered a security incident. A group identified as TeamPCP compromised the PyPI distribution pipeline, pushing versions 1.82.7 and 1.82.8 to the index. These versions contained a .pth file, a mechanism that executes code automatically when the Python interpreter initializes, meaning the malicious payload could run without an explicit import.

The Escalation of Open Source Risks

According to ReversingLabs reports, the volume of malicious open-source packages rose by 73% in 2026. The compromise of LiteLLM was part of a larger operation by TeamPCP, which reportedly targeted widely trusted security tools such as Aqua Security’s Trivy and Checkmarx’s KICS before shifting focus toward AI infrastructure libraries.

The attack chain involved the group obtaining the maintainer’s PyPI publishing credentials to distribute versions that appeared legitimate. These packages contained a multi-stage payload engineered to harvest high-value secrets, including AWS, GCP, and Azure tokens, alongside SSH keys and cloud account credentials. According to Zscaler ThreatLabz, these packages remained available for approximately three hours before they were quarantined.

Expanding Impact on AI Pipelines

The scope of this activity extended beyond LiteLLM. In late April 2026, PyTorch Lightning versions 2.6.2 and 2.6.3 were identified as containing credential-stealing malware. This malware executed upon import, and a single malicious workflow file was capable of exposing secrets across entire CI/CD pipelines.

• 73% increase in malicious open-source packages in 2026.
• 3 hours of availability for poisoned LiteLLM packages.
• 200,000 Python prompts analyzed in recent research.

The Vulnerability of AI Workspaces

AI development environments are uniquely exposed because they integrate research, data access, model publishing, and cloud infrastructure within a single workspace. A compromise in this environment can grant an attacker simultaneous access to model weights, training data, cloud tokens, and production API keys.

Furthermore, developers often rely on AI coding assistants that suggest specific package installations. Recent research indicates that across nearly 200,000 Python prompts, major LLMs frequently generate hallucinated package names, creating an attack surface known as slopsquatting. This persists even after model updates.

Mitigation Through Strict Controls

Security teams are advised to implement specific controls to manage these risks. First, developers should pin dependencies to exact versions and verify checksums against known-good hashes to prevent the installation of malicious updates through floating version specifiers. Second, organizations should audit post-install hooks. Tools such as Socket and Sonatype can provide analysis of PyPI packages for malicious behavior before they are installed.

Finally, if an environment is suspected of exposure, cloud credentials must be rotated immediately. Audit logs should be reviewed for patterns that do not match developer activity, as attackers may attempt to use stolen tokens from different locations.

Implications for Security Strategy

The campaign involving LiteLLM and PyTorch Lightning suggests that AI infrastructure is now a specific target class. Because these packages are foundational to daily AI development, the speed of adoption often outpaces existing security review cycles. The effectiveness of these attacks relies on the fact that malicious .pth files can remain invisible to many standard endpoint detection products. Securing these environments requires applying the same rigor to local developer setups as is applied to production deployments, as the boundary between the two has become increasingly fluid.