Malicious LiteLLM PyPI Releases Stole Cloud and Crypto Credentials

Two malicious litellm releases, versions 1.82.7 and 1.82.8, were briefly published to PyPI in a supply-chain compromise that targeted developers and AI application environments. Reporting and downstream advisories said the packages contained credential-stealing malware aimed at AWS secrets, cloud tokens, and cryptocurrency-related keys, with exposure limited to a roughly four-hour publication window before the releases were removed. The incident was serious enough to trigger updates in the PyPA advisory database and public warnings that the affected versions should be treated as compromised.

Projects that depend on LiteLLM moved quickly to contain the risk, with repositories including OpenHands, MLflow, and dreadnode/rigging pinning safe versions such as litellm<=1.82.6 or otherwise blocking installation of the tainted releases. Community responders also published detection guidance and indicators of compromise tied to the malware campaign, including checks for installations of 1.82.7 and 1.82.8 and references to associated TeamPCP IoCs, while maintainers and users were urged to rotate any exposed credentials and review systems that may have installed the malicious packages.