Two malicious LiteLLM packages — versions 1.82.7 and 1.82.8 — were briefly live on PyPI on March 24, 2026, for roughly 40 minutes before the registry quarantined them. In that window, any Python environment that updated or freshly installed LiteLLM executed a hidden loader file (litellm_init.pth) that ran at interpreter startup, collected environment variables, SSH keys, cloud credentials, Kubernetes tokens, and database passwords, then encrypted and exfiltrated the stolen data to a domain under attacker control. Security firm CloudSEK now reports that the captured loot has been linked to more than 2,100 organizations. High-confidence matches — where both the CI host identity and the organization’s own domain appear in the captured logs — include NVIDIA, Cisco, Deloitte, Volkswagen, FedEx, Siemens, and X Corp.
The attack is tied to the same threat actor behind an earlier supply chain breach targeting Trivy GitHub Action tags. Researchers from Aqua Security and Unit 42 provided corroborating analysis. LiteLLM advises treating any install from March 24 up to 16:00 UTC as suspect even if version 1.82.7 or 1.82.8 is no longer present, because long-lived credentials copied during that window — static cloud keys, SSH keys, publishing tokens — remain usable until explicitly rotated.
How to check if you’re affected
Affected versions include LiteLLM 1.82.7 and 1.82.8 installed in any Python environment on March 24, 2026. Run pip show litellm to confirm your current version, and check pip install logs or CI run histories for activity on that date. If any environment installed LiteLLM that day: rotate all secrets that were available in the environment — AWS/GCP/Azure keys, SSH keys, Kubernetes service account tokens, database passwords, and package-publishing tokens. Neither PyPI version 1.82.7 nor 1.82.8 now appears in the package’s release history; upgrade to 1.83.0 or later.