3.4M Daily Download Supply Chain Attack Exposes Critical Gap in Python Dependency Security
Key Takeaways
- ▸A sophisticated supply chain attack compromised litellm (3.4M daily downloads) using .pth file injection, stealing credentials from unknown numbers of developers, CI/CD systems, and cloud environments within a 3-hour window before detection
- ▸Standard Python security tools (Dependabot, Snyk, pip audit) have 24-48 hour detection lags, leaving a critical vulnerability window during which fresh malicious packages bypass all conventional defenses
- ▸AI coding agents that auto-install dependencies without pre-install security verification represent a new attack surface, as they can propagate compromised packages at machine speed without human review
Summary
A coordinated supply chain attack by threat group TeamPCP compromised litellm, one of the most widely-used AI tooling packages in the Python ecosystem with 3.4 million daily downloads, by injecting malicious .pth files that silently execute credential-stealing payloads at Python startup. The attack exploited a critical vulnerability in how Python processes site-packages files and went undetected for 3 hours before removal—a window during which standard security tools like Dependabot, Snyk, and pip audit proved inadequate, as they operate with 24-48 hour detection lags.
The attack was part of a larger coordinated campaign that used stolen credentials from an initial Trivy compromise to escalate the litellm attack, exfiltrating SSH keys, AWS/GCP tokens, cryptocurrency wallets, and authentication credentials from affected CI/CD pipelines and developer machines. The incident highlights a critical blind spot in AI development workflows, where AI coding agents (Cursor, Claude Code, Codex) automatically install dependencies without verifying whether package versions have been compromised. In response, a new security tool called CodeGuard Pro was developed to provide pre-install verification before pip execution, including detection of malicious .pth files, typosquatting, known-compromised versions, and secret exfiltration patterns.
- Pre-install security scanning (before pip execution) and real-time threat feeds are necessary to defend against sub-day attack windows in the modern supply chain attack landscape
