Litellm PyPI Package Compromised: Malicious Version 1.82.8 Exfiltrated Credentials
Security Alert: Litellm Package Compromise
The litellm Python package, which has approximately 97 million downloads per month and is used to unify API calls to OpenAI, Anthropic, Cohere, and other LLM providers, was compromised on PyPI. A malicious version (1.82.8) was uploaded that exfiltrated sensitive data from affected systems.
What Happened
For approximately one hour, running pip install litellm or installing any package that depends on it (such as DSPy) would trigger data exfiltration. The malicious version collected:
- SSH keys
- AWS, GCP, and Azure credentials
- Kubernetes configuration files
- Git credentials and shell history
- All environment variables (including API keys and secrets)
- Crypto wallet information
- SSL private keys
- CI/CD secrets
The attack was discovered when a user's machine crashed. Andrej Karpathy described it as "the scariest thing imaginable in modern software."
Immediate Action Required
If you installed any Python packages yesterday (especially DSPy or any litellm-dependent tool), assume your credentials are compromised. You should:
- Rotate all potentially affected credentials immediately
- Check your package versions for litellm 1.82.8
- Review the full breakdown in the source for specific remediation steps
The malicious version has been removed from PyPI, but credentials may already have been stolen during the hour the package was active.
📖 Read the full source: r/LocalLLaMA
👀 See Also
AI Vulnerability Discovery Outpacing Patch Deployment Times
A security expert argues that AI tools like Mythos will find vulnerabilities faster than fixes can be deployed, citing Log4j data showing average remediation times of 17 days and a decade-long elimination timeline.
Google TIG Reports First AI-Generated Zero-Day Exploit in the Wild
Google Threat Intelligence Group has identified a threat actor using a zero-day exploit believed to be developed with AI, marking the first observed offensive use of AI for zero-day vulnerability exploitation.
Developer Builds Firecracker MicroVM Sandbox for OpenClaw Security
A developer concerned about LLM security built a bare-metal sandbox using Firecracker microVMs to isolate OpenClaw scripts, with each script running in its own Linux kernel with 128MB RAM cap and no network by default.
Testing Uncensored Qwen 3.5 35B Models for Cybersecurity Questions
A cybersecurity professional tested three uncensored Qwen 3.5 35B models on hacking and security bypass questions, finding significant differences in response quality compared to the original censored model. The uncensored models consistently provided answers where the original model refused or gave incomplete responses.