Observed incident

Malicious LiteLLM PyPI releases carried credential-stealing code

Reported

What happened

LiteLLM disclosed unauthorized PyPI releases 1.82.7 and 1.82.8 containing malicious code designed to collect credentials from affected environments.

Parties and reporting

AI tools and systems: LiteLLM, PyPI, Trivy, GitHub Actions

Outcome

The releases were quarantined and removed, credentials rotated, and a safer release pipeline introduced. LiteLLM said its official Proxy Docker image was unaffected.

Operating lesson

Isolate publishing credentials and security scanners, verify package provenance, and rotate secrets on hosts that installed compromised releases.

Evidence and limits

LiteLLM described the compromised Trivy dependency as its assessed entry path. Package compromise is confirmed; the advisory does not establish how many downstream hosts lost credentials.

Sources