A March 2026 supply‑chain attack injected malicious code into LiteLLM versions 1.82.7/1.82.8, silently stealing API keys, SSH credentials, cloud tokens and more, while a cloud‑native AI gateway from Alibaba offers a secure, zero‑exposure alternative and detailed remediation steps.
An obscure hacker group, TeamPCP, used an AI agent powered by Anthropic’s Claude to trick the open‑source security scanner Trivy into revealing its GitHub credentials, then injected malicious code into Trivy’s updates and subsequently compromised the AI gateway LiteLLM, exposing critical supply‑chain vulnerabilities in popular AI development tools.
LiteLLM provides a single Python SDK and proxy server that let developers call more than 100 large‑language‑model APIs with a uniform OpenAI‑style interface, handling cost tracking, load balancing, rate limiting, and detailed logging to simplify multi‑model experimentation and production deployments.
A malicious PyPI release of litellm (version 1.82.8) injects a .pth file that auto‑executes, harvests SSH keys, cloud credentials, and other secrets, encrypts them, exfiltrates to a fake domain, and can spread through Kubernetes, prompting urgent removal and credential rotation.
A supply‑chain breach of the popular LiteLLM Python library injected malicious .pth files that silently harvest SSH keys, cloud credentials, and other secrets, deploy persistent backdoors, and spread through downstream packages, prompting urgent detection and remediation steps for developers.
The article details how compromised LiteLLM versions 1.82.7 and 1.82.8 on PyPI embed a malicious .pth file that runs on every Python start, harvests credentials, exfiltrates them via an unauthenticated endpoint, and creates Kubernetes pods for lateral movement, then provides detection and remediation steps.
