en.Wedoany.com Reported - A large-scale, months-long software supply chain attack launched by the threat actor TeamPCP is sounding the alarm for the global artificial intelligence industry: AI middleware has become a new strategic springboard for attackers to infiltrate development environments and steal core secrets. As multiple AI unicorns and developer toolchains have successively fallen victim, the risk exposure of software supply chain security has extended from foundational open-source libraries to the core gateways and orchestration layers supporting large model applications.
TeamPCP's attack methods demonstrate an extremely high capability for supply chain engineering infiltration. The attackers exploited developers' inherent trust in security tools like code scanners within CI/CD pipelines, weaponizing them as the entry point for infiltration. In March this year, the group exploited a GitHub Actions workflow configuration flaw in Aqua's open-source security scanner Trivy (widely deployed in various CI/CD pipelines) to gain unauthorized access and steal privileged tokens. This attack directly led to the creation of vulnerability CVE-2026-33634, rated with a high severity score of 9.4 (CVSS), and was added to the Known Exploited Vulnerabilities catalog by the U.S. Cybersecurity and Infrastructure Security Agency (CISA).
After obtaining the "master key" to the developer ecosystem, TeamPCP launched a highly precise, large-scale cross-ecosystem poisoning campaign. On March 24, 2026, the attackers used the stolen credentials to publish versions of the core AI middleware LiteLLM (1.82.7 and 1.82.8) containing data-stealing malicious code to the Python Package Index. LiteLLM, a core gateway that can uniformly proxy calls to over 100 large language model APIs, has an average monthly download volume of approximately 97 million. The malicious code utilized Python's .pth file mechanism to achieve persistent, undetectable residency, automatically executing every time the Python interpreter starts, silently and systematically harvesting SSH keys, various cloud service provider credentials, Kubernetes cluster tokens, and Git credentials from developer environments. Subsequently, the attackers expanded the scope of poisoning to AI inference frameworks and critical development libraries such as Xinference, Telnyx SDK, and the TanStack suite (42 core npm packages).
The internal defenses of numerous AI and tech giants were successively breached during this incident. According to OpenAI's disclosure, TeamPCP's supply chain poisoning of TanStack impacted the company, infecting the corporate devices of two employees and leading to the leakage of access credentials for some internal source code repositories; fortunately, no customer data was found to be stolen. French artificial intelligence company Mistral AI confirmed that its code management and package handling environment was compromised by a third party, resulting in the temporary contamination of some software development kit packages.
The successful strike on high-value hub nodes quickly triggered multiple secondary threats. The attackers claimed to have obtained up to 450 nearly complete code repositories from Mistral AI and publicly demanded a ransom of $25,000, threatening to leak the related data otherwise. Subsequent monitoring by IBM X-Force and SentinelOne found that the vast amount of stolen AI API keys had formed a mature and direct monetization path on dark web markets. Furthermore, SentinelOne discovered a new worm framework codenamed PCPJack within environments compromised by TeamPCP; this worm clears TeamPCP's original malicious payload while implanting its own data-stealing tools, staging a chaotic battle for the takeover and plundering of attack infrastructure.
This series of incidents strongly indicates a fundamental shift in the attackers' tactical focus, moving from indiscriminate scanning to precise, targeted strikes against "high-value, high-privilege, high-dependency" critical hub nodes within the AI technology stack. AI middleware, represented by LiteLLM, constitutes a highly valuable aggregation point for credentials due to its operational necessity of consolidating numerous downstream large model and cloud service API keys. Once this middle layer is breached, attackers can move laterally to Kubernetes clusters, escalating a localized component intrusion into a platform-level disaster affecting production environments and core data assets.
In its in-depth incident analysis, the Cloud Security Alliance (CSA) warned that AI middleware sits at the core intersection of data flow and key management. Such middle-layer components, previously overlooked from a traditional security perspective, must now be treated as critical information infrastructure, subject to strict continuous monitoring, key isolation, and least privilege controls to prevent software supply chain attacks from triggering a chain collapse through the trust chain.
This article is compiled by Wedoany. All AI citations must indicate the source as "Wedoany". If there is any infringement or other issues, please notify us promptly, and we will modify or delete it accordingly. Email: news@wedoany.com
