LiteLLM Python package at a glance
On March 24, 2026, two malicious LiteLLM releases were uploaded to PyPI outside the project's CI/CD and harvested SSH keys, cloud credentials, and API keys. LiteLLM says the official Docker image was not affected.
LiteLLM Python package: status
- Affected
- litellm 1.82.7 and 1.82.8 installed from PyPI on March 24, 2026, including unpinned transitive installs and Docker images built with unpinned pip installs
- CVE identifiers
- Not published
- Status as of
What changed with LiteLLM Python package
LiteLLM, a widely used Python library and proxy that routes requests to many LLM providers, disclosed that versions 1.82.7 and 1.82.8 published to PyPI on March 24, 2026 contained malware. The packages went live at 10:39 UTC and were quarantined by PyPI roughly 40 minutes later; LiteLLM's guidance treats installs up to 16:00 UTC as potentially affected. GitHub's advisory GHSA-5mg7-485q-xm76 rates it critical.
Version 1.82.7 hid the payload in the proxy server module, and 1.82.8 added a litellm_init.pth file that runs on any Python startup. The code collected environment variables, SSH keys, AWS, GCP, and Azure credentials, Kubernetes tokens, and database passwords, then sent them to models.litellm.cloud, which is not a LiteLLM domain. LiteLLM says the attacker bypassed its official CI/CD and believes the compromise began with the Trivy dependency in its security scanning workflow; Mandiant was engaged to investigate.
LiteLLM says the official Proxy Docker image, ghcr.io/berriai/litellm, LiteLLM Cloud, and installs pinned to 1.82.6 or earlier were not affected. It released v1.83.0 through a rebuilt CI/CD pipeline and published checksums for earlier clean releases.
How to fix it: LiteLLM Python package
1. Monitor
Audit local environments, CI/CD, Docker builds, and deployment logs for litellm 1.82.7 or 1.82.8, and search site-packages for litellm_init.pth.
docs.litellm.ai (opens in a new tab)2. Workaround
On any affected system, remove litellm_init.pth, investigate the host, and rotate every secret that was available there.
docs.litellm.ai (opens in a new tab)3. Update
Pin to 1.82.6 or earlier, or to a verified later release such as v1.83.0 built through LiteLLM's new CI/CD pipeline.
docs.litellm.ai (opens in a new tab)
Advisories
Where to compare LiteLLM Python package
Independent leaderboards and official resources for comparing this model yourself. Rankings change often; each site shows its own current data.
Why LiteLLM Python package matters for businesses
AI gateways like LiteLLM sit on machines that hold keys for every model provider a company uses, which makes them a prime target. Unpinned installs and transitive dependencies were the main exposure path, so this is a strong case for pinning versions, verifying hashes, and rotating secrets quickly after any suspect install.
Sources for this story
- Security Update: Suspected Supply Chain Incident (opens in a new tab)Official
LiteLLM · docs.litellm.ai
- Two LiteLLM versions published containing credential harvesting malware (GHSA-5mg7-485q-xm76) (opens in a new tab)Official
GitHub Advisory Database · github.com
- litellm PyPI package (v1.82.7 + v1.82.8) compromised: full timeline and status (issue #24518) (opens in a new tab)Official
BerriAI/litellm on GitHub · github.com
Last verified: . IA Compa summarizes public announcements for business readers. We are not affiliated with the companies mentioned. Always confirm details, pricing, and availability with the official source.
- #security
- #supply-chain
- #litellm
- #pypi
- #malware
- #ai-gateway