Litellm PyPI Package Compromised: Malicious Version 1.82.8 Exfiltrated Credentials
Security Alert: Litellm Package Compromise
The litellm Python package, which has approximately 97 million downloads per month and is used to unify API calls to OpenAI, Anthropic, Cohere, and other LLM providers, was compromised on PyPI. A malicious version (1.82.8) was uploaded that exfiltrated sensitive data from affected systems.
What Happened
For approximately one hour, running pip install litellm or installing any package that depends on it (such as DSPy) would trigger data exfiltration. The malicious version collected:
- SSH keys
- AWS, GCP, and Azure credentials
- Kubernetes configuration files
- Git credentials and shell history
- All environment variables (including API keys and secrets)
- Crypto wallet information
- SSL private keys
- CI/CD secrets
The attack was discovered when a user's machine crashed. Andrej Karpathy described it as "the scariest thing imaginable in modern software."
Immediate Action Required
If you installed any Python packages yesterday (especially DSPy or any litellm-dependent tool), assume your credentials are compromised. You should:
- Rotate all potentially affected credentials immediately
- Check your package versions for litellm 1.82.8
- Review the full breakdown in the source for specific remediation steps
The malicious version has been removed from PyPI, but credentials may already have been stolen during the hour the package was active.
📖 Read the full source: r/LocalLLaMA
👀 See Also
Domain-Camouflaged Injection Attacks Evade Detectors in Multi-Agent LLM Systems
A new paper shows injection payloads tailored to domain vocabulary evade detection, dropping IDR from 93.8% to 9.7%. Multi-agent debate amplifies attacks. Llama Guard 3 detects zero payloads.
How AI Text Watermarking Works: Secret Keys, Green/Red Word Choices, and Detection
Text watermarking hides marks in word choices, not characters. A secret key tilts word selection toward green, and detection counts green words to spot AI-generated text.
Configuring OpenClaw for Encrypted LLM Inference Using TEE Enclaves
A developer shares how they configured OpenClaw to use Onera's AMD SEV-SNP trusted execution environments for end-to-end encrypted LLM inference, including configuration examples and technical tradeoffs.
VulnHunter: Capital One's Agentic AI Code Security Tool Now Open Source
Capital One open-sourced VulnHunter, an agentic AI tool that simulates attacker entry points, falsifies findings to cut false positives, and generates targeted code fixes.