{"id":166049,"date":"2026-03-24T23:12:56","date_gmt":"2026-03-24T21:12:56","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-pypi-razmeshheny-vredonosnye-vypuski-biblioteki-litellm-naschityvayushhej-95-mln-zagruzok-v-mesyacz"},"modified":"2026-03-24T23:12:56","modified_gmt":"2026-03-24T21:12:56","slug":"v-pypi-razmeshheny-vredonosnye-vypuski-biblioteki-litellm-naschityvayushhej-95-mln-zagruzok-v-mesyacz","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/v-pypi-razmeshheny-vredonosnye-vypuski-biblioteki-litellm-naschityvayushhej-95-mln-zagruzok-v-mesyacz","title":{"rendered":"Malicious releases of the LiteLLM library, which has 95 million downloads per month, have been posted on PyPI.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
The developers of the Python library LiteLLM, which has 95 million downloads per month and 3.5 million in the last 24 hours, reported a compromise of the project. Attackers managed to intercept the maintainer's credentials and published two malicious releases in PyPI \u2014 1.82.7 and 1.82.8, containing code to steal keys and passwords from user systems. Currently, the malicious versions have been removed from PyPI, and the project is temporarily frozen pending an investigation. <\/p>\n
The access token for the LiteLLM account on PyPI fell into the hands of attackers due to the use of the dependency security scanner trivvy in the continuous integration system. Previously, at the end of February, attackers gained access to the Trivy project infrastructure by exploiting a vulnerability in the pull_request_target handler, which runs in the Trivy continuous integration system. After the compromise, the attackers published malicious releases of Trivy 0.69-0.69, replaced the GitHub Action handler trivy-action, and uploaded a modified Docker image with Trivy. <\/p>\n
On March 24 at 11:30 AM (MSK), the intercepted credentials of LiteLLM's maintainer (krrishdholakia) were used for the direct publication of malicious LiteLLM releases 1.82.7 and 1.82.8 in PyPI, bypassing the official GitHub CI\/CD. The project's repository on GitHub was unaffected \u2014 malicious activity was observed only in PyPI. In the LiteLLM 1.82.7 release, malicious code was embedded in the file litellm\/proxy\/proxy_server.py and was activated upon importing litellm.proxy. In the 1.82.8 release, a file site-packages\/litellm_init.pth was included, and a handler was added to the proxy_server.py file, packed in base64 format and activated on any run. <\/p>\n
The added malicious code conducted scanning and sent confidential data. It transmitted the SSH and SSL\/TLS keys found on the system, the contents of environment variables, credentials for AWS, GCP, Azure, and K8s, keys from cryptocurrency wallets, passwords to databases, command interpreter operation history, configuration files from Git, CI\/CD, package managers, and Docker. The discovered data was encrypted using AES-256-CBC + RSA-4096 algorithms and sent via an HTTP POST request to the site \"https:\/\/models.litellm.cloud\/\"domain<\/a> litellm.cloud was registered just a few hours before the publication of the malicious releases). <\/p>\n