IT Services Circle

Mar 28, 2026 · Information Security

How a Malicious litellm Update Turned Python AI Tools into a Supply‑Chain Bomb

On March 24, former OpenAI researcher Andrej Karpathy warned that a textbook‑level supply‑chain attack compromised the popular Python library litellm via a malicious .pth file, allowing automatic execution of code that harvests SSH keys, cloud credentials, and other secrets, with the breach traced back to a hijacked Trivy CI/CD pipeline.