litellm Supply Chain Attack (March 2026): How TeamPCP Backdoored a PyPI Package Used by Millions