Alexey Pavlenko alexthec0d3r

name	litellm-compromise-check
description	Check local or remote systems for indicators of the LiteLLM/TeamPCP supply chain compromise (March 24, 2026)
version	2.0.0
author	Alexey Pavlenko (@alexthec0d3r)

LiteLLM / TeamPCP Supply Chain Compromise Check

Scan the current system (or a remote system via SSH) for indicators of compromise from the TeamPCP supply chain attack that hit LiteLLM versions 1.82.7 and 1.82.8 on March 24, 2026.

	-- Create a group
	CREATE ROLE readaccess;

	-- Grant access to existing tables
	GRANT USAGE ON SCHEMA public TO readaccess;
	GRANT SELECT ON ALL TABLES IN SCHEMA public TO readaccess;

	-- Grant access to future tables
	ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT ON TABLES TO readaccess;