On July 10, 2026, SlowMist, a blockchain security firm, revealed that the popular Python AI gateway library LiteLLM has been compromised in a PyPI supply chain attack. With a staggering 97 million monthly downloads, LiteLLM is widely used in AI development. The attack exploits the pip install litellm command to execute malicious code, enabling attackers to exfiltrate sensitive data from victims' devices.
Scope of Stolen Data
According to 23pds, SlowMist's CISO, the compromised package can harvest SSH keys, cloud service credentials (AWS, GCP, Azure), Kubernetes configuration files, Git credentials, API keys from environment variables, shell history, cryptocurrency wallet information, and database passwords. This data could lead to cloud infrastructure takeover, digital asset theft, and source code repository breaches.
Security Recommendations and Context
23pds strongly advises all LiteLLM users to immediately verify the integrity of their installations by checking package hashes and ensuring they downloaded from official sources. This attack is part of a rising trend of cross-registry supply chain attacks targeting crypto and AI developers. Previously, SlowMist identified malicious packages on npm, PyPI, and Crates.io (e.g., TrapDoor Stealer), as well as vulnerabilities in OpenAI Codex. Cryptocurrency developers are especially vulnerable as stolen wallet credentials can lead to direct financial loss.
Given the wide adoption of LiteLLM, the impact could be severe. Security experts call for enhanced package review processes on PyPI and recommend developers use pip install --no-deps or verify checksums in requirements.txt. Regularly rotating credentials and using hardware wallets for crypto assets are also effective countermeasures.