On March 24, 2026, malicious code was published to PyPI in LiteLLM versions 1.82.7 and 1.82.8. LiteLLM attributed the suspected route to a compromised Trivy dependency in its CI/CD security-scanning workflow; the Python Package Index (PyPI) also described an exposed API token. The incident shows how a compromised build dependency can become a path to publishing credentials—and why installing a package is not the same as verifying how its artifact was produced.
What happened in the LiteLLM incident
LiteLLM’s March 24 security update identified two affected PyPI releases. The project said the malicious payload searched for secrets on systems where the package ran, including environment variables, SSH keys, cloud credentials, Kubernetes tokens and database passwords. It reported that collected data was encrypted and sent to models.litellm.cloud, a domain the project described as nonofficial.
As an Amazon Associate I earn from qualifying purchases.
| PyPI release | What the project reported | Execution detail |
|---|---|---|
litellm==1.82.7 |
Malicious payload in proxy_server.py (LiteLLM, March 24, 2026 incident update). |
Endor Labs reported that the injected code ran when that module was imported. |
litellm==1.82.8 |
The same payload plus a litellm_init.pth file (LiteLLM, March 24, 2026 incident update). |
Endor Labs reported that the .pth file could run code when the Python interpreter started, even if LiteLLM was not imported. |
Endor Labs also reported attempted Kubernetes lateral movement and installation of a persistent systemd backdoor. Those are findings from the researchers’ technical analysis, not details to attribute to LiteLLM’s own incident update.
Recommended Free Tools
How the attack reached the release path
In its March 27 security town hall, LiteLLM described three conditions in the pipeline: CI steps shared an execution environment and context; publishing credentials for PyPI, GHCR and Docker were static values in environment variables; and the security-scanning component used an unpinned Trivy dependency. The project’s account was that the compromised scanner ran where it could access environment variables, allowing attackers to obtain credentials used in the release path. PyPI’s April 2 incident report likewise described an API token exposure through an exploited Trivy dependency.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
LiteLLM summarized its account this way: “In summary: a compromised package in CI had access to secrets it should not have had, and those secrets were then used in the release path.” The statement is the project’s explanation, not an independent forensic conclusion.
The security lesson is broader than any one package: a scanner or build dependency can become a release-authority risk when it runs with access to secrets or other privileged steps. A valid registry identity on a package does not, by itself, establish that the artifact followed the intended source, build, review and release process.
Who may have been exposed
Exposure depended on the package source, version, timing and whether the affected code ran. LiteLLM said the following paths were affected or not affected by this specific incident:
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
- Potentially exposed: installations or upgrades through pip during the March 24 window that resolved to 1.82.7 or 1.82.8; unpinned installs that resolved to either version; builds made during the window using unpinned
pip install litellm; and transitive unpinned dependencies that pulled in either affected release. - Reported unaffected by this incident: LiteLLM Cloud, the official Proxy Docker image, source installs from the GitHub repository, and versions at or below 1.82.6 that were not upgraded during the window.
These are incident-specific scope statements from LiteLLM, not assurances that those paths are free of other security risks. The official Proxy Docker image’s dependency path, according to the project, did not rely on the affected PyPI packages.
PyPI reported more than 119,000 downloads of the exploited LiteLLM versions. That is a download count—not a count of infected machines, successful credential theft or confirmed victims. PyPI also reported about 15–20 million LiteLLM installs per week, a measure of package scale rather than incident impact. The reviewed accounts do not establish how many organizations or systems were successfully compromised.
Why the exposure-window figures differ
The timing descriptions from LiteLLM and PyPI use different terms and do not reconcile into one confirmed exposure duration. LiteLLM said the packages were live from 10:39 UTC for about 40 minutes before PyPI quarantine, and said it worked with PyPI to delete them by 16:00 UTC on March 24. PyPI’s April 2 report gives an upload-to-quarantine duration of 2 hours 32 minutes. These figures describe the sources’ accounts; they should not be combined into a single asserted window.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
What to do if an affected version ran
LiteLLM advised anyone who installed or ran either affected version to treat credentials available to that system as compromised. Prioritize containment and credential replacement, then investigate where the package was installed, built or deployed.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →- Identify affected systems and artifacts. Check package lockfiles, build logs, deployment records, local environments and container build histories for versions 1.82.7 or 1.82.8, including transitive dependency resolution during the incident window.
- Rotate credentials that were accessible. Replace API keys, cloud access keys, database passwords, SSH keys, Kubernetes tokens and secrets stored in environment variables or configuration files. Revoke old credentials rather than merely changing where they are stored.
- Inspect hosts and pipelines. LiteLLM specifically advised checking for
litellm_init.pthand investigating affected hosts, CI/CD pipelines, Docker builds and deployment logs. Because Endor Labs reported additional persistence and Kubernetes behaviors, include relevant host and cluster activity in the investigation. - Replace affected artifacts from a trusted release path. Do not assume that deleting a package from an environment removes any code or credentials it may already have accessed. Rebuild or redeploy after establishing a clean source and release path, and review the project’s verified-release information for the specific artifact you intend to use.
LiteLLM said it removed the affected packages from PyPI, rotated maintainer credentials, engaged Mandiant for forensic analysis and released v1.83.0 on March 30 through a new pipeline. The project also said on March 27 that its last 20 releases had no indicators of compromise and that no malicious code had been pushed to main. These are statements about the incident response at those dates; the historical v1.83.0 release is not a recommendation for what to install now.
Release-engineering controls that address this failure mode
Pin dependencies and workflow actions
Pin build dependencies and GitHub Actions to reviewed versions or immutable commit SHAs rather than floating references such as latest. LiteLLM said it pinned GitHub Actions and recommended pinned, verified SHAs. Pinning makes a build’s inputs more controlled and reviewable; it does not prove a pinned component is safe.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Separate scanning, testing and publishing
Run unit tests, integration tests and security scans in isolated environments, and keep release publishing separate from lower-trust jobs. LiteLLM described this separation as part of its planned pipeline. The objective is to prevent a compromised scanner or test dependency from inheriting access to publishing credentials simply because it runs in the same context.
Use short-lived, narrowly scoped credentials
Avoid long-lived publishing tokens where an identity-based, ephemeral credential flow is available. LiteLLM described moving to ephemeral credentials and PyPI Trusted Publishers; PyPI also recommends Trusted Publishers instead of API tokens. Limit each credential to the particular repository, workflow and publishing action that needs it.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Consider dependency cooldowns
PyPI recommends dependency cooldowns that delay adoption of newly released dependencies, giving maintainers time to investigate suspicious updates. A delay can reduce exposure to a malicious release that is noticed quickly, but it is a risk-reduction measure—not evidence that a release is safe once the waiting period ends.
Best Value
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
Verify artifact provenance
LiteLLM said GHCR Docker images beginning with v1.83.0-nightly were signed with Cosign and that it published verification instructions. Signature verification checks an artifact against a trusted key and helps establish whether the artifact matches the expected signing identity. It does not establish that the artifact contains no defects or malicious code.
Protect maintainer accounts
PyPI’s guidance includes two-factor authentication for maintainer accounts. A FIDO2 hardware security key is one practical way to provide hardware-backed second-factor authentication. Account MFA helps protect account access, but by itself it would not fix shared CI environments, unpinned scanner dependencies or publishing secrets available too broadly.
What this incident does—and does not—say about LiteLLM
This was a malicious-package incident involving two PyPI artifacts, not evidence that LiteLLM’s ordinary application code in every release was inherently vulnerable. The documented exposure arose when the affected package ran, with a broader interpreter-startup behavior reported for 1.82.8 by Endor Labs. The incident accounts identify the compromised versions and describe specific unaffected paths, but they do not provide a confirmed victim count or establish the current LiteLLM release as of October 2026. Verify the current official release and its provenance before choosing a version.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
