Skip to content

Instantly share code, notes, and snippets.

View RitvikDayal's full-sized avatar
🎯
Focusing

Ritvik Dayal RitvikDayal

🎯
Focusing
View GitHub Profile
@RitvikDayal
RitvikDayal / USAGE.md
Last active March 28, 2026 06:01
litellm-sweep: Scan your system for traces of the compromised litellm package (TeamPCP supply chain attack, March 2026). Checks pyenv, virtualenvs, conda, pip cache, Homebrew, source code references, persistence artifacts, network IOCs, and Kubernetes IOCs.

litellm-sweep

Scan your entire system for traces of the compromised litellm Python package.

Built in response to the TeamPCP supply chain attack (March 24, 2026) where versions 1.82.7 and 1.82.8 were published to PyPI with a backdoor that harvests credentials, establishes persistence, and exfiltrates data to a C2 server.

Reference: https://snyk.io/articles/poisoned-security-scanner-backdooring-litellm/

Quick Start