{"id":166049,"date":"2026-03-24T23:12:56","date_gmt":"2026-03-24T21:12:56","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-pypi-razmeshheny-vredonosnye-vypuski-biblioteki-litellm-naschityvayushhej-95-mln-zagruzok-v-mesyacz"},"modified":"2026-03-24T23:12:56","modified_gmt":"2026-03-24T21:12:56","slug":"v-pypi-razmeshheny-vredonosnye-vypuski-biblioteki-litellm-naschityvayushhej-95-mln-zagruzok-v-mesyacz","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hu\/blog\/news\/v-pypi-razmeshheny-vredonosnye-vypuski-biblioteki-litellm-naschityvayushhej-95-mln-zagruzok-v-mesyacz","title":{"rendered":"A PyPI-n k\u00e1rt\u00e9kony kiad\u00e1sok tal\u00e1lhat\u00f3k a LiteLLM k\u00f6nyvt\u00e1rb\u00f3l, amelynek havi let\u00f6lt\u00e9sei 95 milli\u00f3.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
A Python library developer, LiteLLM, which has 95 million downloads per month and 3.5 million in the last day, reported a compromise of the project. Attackers were able to intercept the maintainer's credentials and publish two malicious releases in PyPI \u2014 1.82.7 and 1.82.8, containing code to steal keys and passwords from users' systems. Currently, the malicious versions have been removed from PyPI, and the project is temporarily frozen until the investigation is complete. <\/p>\n
The access token for the LiteLLM account in PyPI fell into the hands of attackers due to the use of a dependency security scanner trivvy in the continuous integration system. Earlier in late February, attackers were able to access the Trivy project infrastructure by exploiting a vulnerability in the pull_request_target handler triggered in the Trivy continuous integration system. After the compromise, the attackers published malicious Trivy releases 0.69-0.69, replaced the GitHub Action handler trivy-action, and posted a modified Docker image with Trivy. <\/p>\n
On March 24 at 11:30 (MSK), the intercepted credentials of the LiteLLM maintainer (krrishdholakia) were used to directly publish the malicious releases LiteLLM 1.82.7 and 1.82.8 in PyPI, bypassing the official GitHub CI\/CD. The project repository on GitHub was not affected \u2014 malicious activity was observed only in PyPI. In the LiteLLM 1.82.7 release, the malicious code was embedded in the file litellm\/proxy\/proxy_server.py and was activated upon importing litellm.proxy. In the 1.82.8 release, a file site-packages\/litellm_init.pth was included, and a handler packed in base64 format was added to the proxy_server.py file, activated on any launch. <\/p>\n
The added malicious code performed scanning and sent confidential data. Found SSH and SSL\/TLS keys, environment variable contents, credentials to AWS, GCP, Azure, and K8s, cryptocurrency wallet keys, database passwords, command interpreter operation history, configuration files from Git, CI\/CD, package managers, and Docker were sent. The discovered data was encrypted using AES-256-CBC + RSA-4096 algorithms and sent via HTTP POST request to the site \"https:\/\/models.litellm.cloud\/\".domain<\/a> litellm.cloud was registered a few hours before the publication of the malicious releases). <\/p>\n