LiteLLM Package Compromised

mttaggart · March 24, 2026, 3:01pm

Alert: [Security]: litellm PyPI package compromised — full timeline and status · Issue #24518 · BerriAI/litellm · GitHub

Original Analysis: [Security]: CRITICAL: Malicious litellm_init.pth in litellm 1.82.8 — credential stealer · Issue #24512 · BerriAI/litellm · GitHub

Evil code like:

import os, subprocess, sys; subprocess.Popen([sys.executable, "-c", "import base64; exec(base64.b64decode('...'))"])

neurovagrant · March 24, 2026, 3:03pm

litellm[.]cloud connected to 46.151.182[.]203 - the whole /24 is baaaaaad. ASN 205759.

mttaggart · March 24, 2026, 3:25pm

There’s some confusion about which versions were affected. This issue seems to be up-to-date.

PyPi has pulled the entire package.

github.com/BerriAI/litellm

[Security]: litellm PyPI package compromised — full timeline and status

opened 01:48PM - 24 Mar 26 UTC

isfinne

llm translation

## Summary The litellm PyPI package was compromised by an attacker who gained a…ccess to the maintainer's PyPI account. Malicious versions were published that steal credentials and exfiltrate them to an attacker-controlled server. Original detailed analysis: https://github.com/BerriAI/litellm/issues/24512 Hacker News discussion: https://news.ycombinator.com/item?id=47501729 ## What happened - The maintainer's PyPI account (`krrishdholakia`) appears to have been hijacked by an attacker (`teampcp`) - The attacker published malicious versions to PyPI that were never released through the official GitHub CI/CD - GitHub releases only go up to `v1.82.6.dev1` — versions 1.82.7 and 1.82.8 on PyPI were uploaded directly by the attacker ## Affected versions | Version | Method | Trigger | |---------|--------|---------| | 1.82.7 | Payload embedded in `litellm/proxy/proxy_server.py` | Triggered on `import litellm.proxy` | | 1.82.8 | Added `litellm_init.pth` (34,628 bytes) + payload in `proxy_server.py` | **Any Python startup** — no import needed | Other versions may also be affected and should be audited. ## What the malicious code does 1. **Collects**: SSH keys, environment variables (API keys, secrets), AWS/GCP/Azure/K8s credentials, crypto wallets, database passwords, SSL private keys, shell history, CI/CD configs 2. **Encrypts**: AES-256-CBC + RSA-4096 (hardcoded public key) 3. **Exfiltrates**: `curl POST` to `https://models.litellm.cloud/` The exfiltration domain `litellm.cloud` (NOT the official `litellm.ai`) was registered on **2026-03-23** via Spaceship, Inc. — just hours before the malicious packages appeared. ## Current status - **PyPI**: The entire litellm package has been suspended/removed. All versions currently return "No matching distribution found." We reported the malware to PyPI via the official "Report malware" form. - **GitHub Issue #24512**: Contains the original detailed technical analysis (currently closed by the attacker's spam — see below). - **Attacker behavior**: The attacker appears to be publishing hundreds of spam comments to suppress discussion. If this continues, we recommend moderating via the Hacker News thread linked above. ## Recommendations for affected users 1. Check if `litellm_init.pth` exists in your `site-packages/` directory 2. **Rotate ALL credentials** that were present as environment variables or config files on any system where litellm 1.82.7+ was installed 3. Pin dependencies to exact versions and verify against GitHub releases 4. Monitor for unauthorized access using any potentially leaked credentials ## References - Original analysis: #24512 - Hacker News: https://news.ycombinator.com/item?id=47501729 - Attacker's exfil domain WHOIS: registered 2026-03-23, Spaceship Inc., privacy-protected - `litellm_init.pth` SHA256: `ceNa7wMJnNHy1kRnNCcwJaFjWX3pORLfMh7xGL8TUjg`

And a valuable putative timeline, showing Trivy as the access vector: [Security]: litellm PyPI package (v1.82.7 + v1.82.8) compromised — full timeline and status · Issue #24518 · BerriAI/litellm · GitHub

neurovagrant · March 24, 2026, 4:48pm

Can’t post the evidence in the clear, but TeamPCP is directly and purposely targeting scanning and security solutions.

mttaggart · March 24, 2026, 5:02pm

This follows, since they claimed responsibility for the Trivy compromise:

mttaggart · March 24, 2026, 5:14pm

Aaaand KICS:

mttaggart · March 24, 2026, 6:14pm

Interesting direct quotes from Mandiant IR here: