Supply Chain Attack Compromises LiteLLM Python Library, Delivering Data‑Stealing Malware to AI Workloads
What Happened — In March 2026 attackers hijacked the PyPI distribution channel for the popular Python library LiteLLM, uploading trojanized versions 1.82.7 and 1.82.8. The malicious code activates on import or interpreter start, steals cloud‑service credentials (AWS, Kubernetes, NPM), database configurations (MySQL, PostgreSQL, MongoDB) and crypto‑wallet data, and can establish persistence inside Kubernetes clusters.
Why It Matters for TPRM —
- Open‑source dependencies are a common third‑party risk vector; a compromised library can affect every downstream product that bundles it.
- The payload targets high‑value cloud and database secrets, creating a pathway to broader enterprise compromise.
- Detection is difficult because the malicious code is hidden in base‑64 blobs and executed only under specific conditions.
Who Is Affected — Cloud‑native SaaS vendors, DevOps toolchains, AI‑platform providers, any organization that integrates LiteLLM into production workloads (TECH_SAAS, CLOUD_INFRA, FIN_SERV).
Recommended Actions —
- Immediately audit all environments for the presence of LiteLLM 1.82.7/1.82.8 or any newer unverified releases.
- Remove compromised packages and replace with vetted versions from trusted mirrors.
- Rotate all cloud and database credentials that may have been exposed; enforce least‑privilege IAM policies.
- Implement SBOM (Software Bill of Materials) monitoring and enforce signed package verification for Python dependencies.
Technical Notes — The attack leveraged a third‑party dependency vector by compromising the PyPI repository. Malicious code was base64‑encoded in proxy_server.py (v1.82.7) and a .pth loader (v1.82.8), which writes a p.py payload that executes a second base64‑encoded script. The payload harvests AWS access keys, Kubernetes kubeconfig files, NPM tokens, database connection strings, and cryptocurrency wallet seeds, then exfiltrates them to attacker‑controlled C2 endpoints. Source: SecureList – Litellm Supply‑Chain Attack