Attackers compromised the LiteLLM Python library on PyPI in March, injecting credential-stealing malware into two releases that remained available for approximately 40 minutes. The malicious versions targeted systems running the popular open-source LLM abstraction layer, harvesting cloud API keys, SSH credentials, Kubernetes tokens, database passwords, and other sensitive secrets from infected machines.

CloudSEK's threat intelligence team analyzed captured data from roughly 434,000 files extracted during the attack. The firm's analysis maps exposure across 2,100 or more organizations that likely downloaded the compromised packages during the brief window of availability.

The attack leveraged the Trivy supply chain vulnerability, indicating the initial compromise occurred through infrastructure weakness rather than direct credential theft. Attackers gained sufficient access to publish malicious releases under the legitimate package name, a tactic that exploits the trust developers place in established open-source projects.

The credential-stealing payload operated silently during installation, exfiltrating secrets to attacker-controlled infrastructure before removal. The 40-minute window before detection suggests either automated monitoring flagged the packages or manual code review identified anomalies. Organizations using LiteLLM for large language model integrations faced direct exposure, as the library runs with the privileges of whatever application installed it.

Developers who installed versions 1.30.1 or 1.30.2 of LiteLLM during the March timeframe should assume credential compromise. Recommended actions include rotating all cloud API keys, SSH keys, Kubernetes authentication tokens, and database passwords accessed by systems running those versions. Teams should review cloud audit logs and identity provider access records for unauthorized activity during and after the installation period.

LiteLLM's popularity in AI development pipelines amplified exposure scope. The library abstracts multiple LLM providers, meaning many organizations depend on it for production