LiteLLM, an AI open-source package with nearly 97 million monthly downloads, was hit by a supply chain attack after two PyPI releases, v1.82.7 and v1.82.8, were published with malicious code. The malware was designed to steal crypto wallet files, SSH keys, cloud credentials, and other sensitive data. Both affected versions were removed on March 24, but systems that installed them may still be compromised.
Researchers traced the breach to stolen PyPI credentials
The first public disclosure came from FutureSearch engineer Daniel Hnyk. He and Callum McMahon noticed suspicious behavior while introducing LiteLLM as an indirect dependency through a Cursor MCP plugin, then began reverse engineering the package. Their analysis linked the operation to TeamPCP. According to the report, the group had previously breached the CI/CD pipeline of the open-source security scanner Trivy, obtained the LiteLLM maintainer's PyPI account credentials, and used them to upload backdoored releases.
The malware ran in three stages inside developer environments
Stage one focused on credential collection. A malicious .pth file named litellm_init.pth would execute automatically every time a Python process started, without requiring any explicit import. The data targeted included SSH keys, .env files containing API secrets, AWS, GCP, and Azure cloud credentials, Kubernetes configuration, Git credentials, shell history, cryptocurrency wallet files, and database passwords.
Stage two handled exfiltration. Stolen data was encrypted with a hard-coded 4096-bit RSA public key together with AES-256-CBC, packaged into a tar archive, and sent via POST requests to https://models.litellm.cloud/. The report said this domain had no connection to the official LiteLLM project and served as an attacker-controlled endpoint.
Stage three expanded access and established persistence. If a Kubernetes token was present on the host, the malware would read secrets across all namespaces and deploy privileged alpine:latest Pods on each kube-system node with the host filesystem mounted. It also installed a persistent backdoor at /root/.config/sysmon/sysmon.py and created a systemd user service so the malicious code would survive reboots.
The malicious window lasted about nine hours
The incident unfolded quickly. The timeline shows that v1.82.8 was uploaded at 10:52 UTC on March 24; by 12:30 UTC, v1.82.7 was also confirmed to be compromised; at 13:03 UTC, a GitHub issue warning about the attack was mistakenly flagged as spam by a bot and closed as “not planned,” delaying broader public notice; the packages were finally removed from PyPI at 20:15 UTC. That left an exposure window of roughly nine hours.
Crypto developers face direct key and wallet risk
LiteLLM is widely used as an AI model gateway, including in parts of the infrastructure stack for crypto and DeFi AI agents. Because the malware explicitly targeted wallet files, developers running LiteLLM on machines that also stored digital assets faced immediate risk. The report also warned that LiteLLM could be pulled in as an indirect dependency through MCP plugins, making the compromise easy to miss.
Users who installed LiteLLM were advised to check their version with pip show litellm, remove the affected releases, and clear the pip cache. They should also inspect whether ~/.config/sysmon/sysmon.py or sysmon.service exists, and in Kubernetes environments scan the kube-system namespace for node-setup-* Pods. Most importantly, the report said all SSH keys, cloud credentials, API keys, and crypto wallet private keys should be treated as exposed and rotated immediately.