Two malicious LiteLLM releases remained on PyPI for approximately 40 minutes in March, carrying credential-stealing code that could harvest cloud keys, SSH keys, Kubernetes tokens, database passwords, and other secrets from systems that installed them. Threat intelligence firm CloudSEK now reports a dataset it obtained, built from roughly 434,000 files captured by the attackers, maps potential exposure to over 2,500 organizations. CloudSEK revealed that the information stemmed from undisclosed confidential intelligence sources and includes seized assets and log entries assessed by the company as pertaining to a specific campaign, rather than data collected from the entities named.
The project identified versions 1.82.7 and 1.82.8 as compromised and stated that they were live on March 24 from 10:39 UTC for approximately 40 minutes before PyPI quarantined them, although it advises users to treat any installs from that date until 16:00 UTC as potentially suspect. The compromised packages were designed to gather and encrypt sensitive information like environment variables, SSH keys, cloud credentials, Kubernetes tokens, and database passwords before sending them to an attacker-controlled domain called `litellm.cloud`. It’s more concerning if a team knowingly installs LiteLLM than whether anything on the host was installed intentionally, and project advisory notes indicate that an unpinned transitive dependency, including one pulled by an agent framework or orchestration tool, could deliver it without anyone choosing it.
