LITELLM PYPI COMPROMISE EXFILTRATED CLOUD AND CI/CD SECRETS; PIN AND ROTATE NOW
The popular LiteLLM PyPI package was briefly compromised, exfiltrating cloud and CI/CD secrets with links to a broader Trivy supply‑chain attack. PyPI confirme...
The popular LiteLLM PyPI package was briefly compromised, exfiltrating cloud and CI/CD secrets with links to a broader Trivy supply‑chain attack.
PyPI confirmed two malicious LiteLLM versions (1.82.7, 1.82.8) carried a three‑stage payload stealing AWS/GCP/Azure creds, Kubernetes configs, SSH keys, and pipeline secrets, then establishing persistence and enabling follow‑on payloads InfoWorld. Researchers tied this to the TeamPCP campaign that earlier hit Trivy and other targets, with lateral movement via privileged pods and a systemd backdoor also observed TechRadar.
Daniel Hnyk’s BigQuery analysis found 46,996 downloads across the two tainted releases during a 46‑minute window, underscoring the risk ripple into downstream dependents Simon Willison. Some projects are already pinning to safe versions and checking in lockfiles to contain blast radius (e.g., MassGen pinned litellm<=1.82.6 and committed uv.lock) MassGen release.
A core AI middleware in many stacks briefly shipped malware that steals cloud, Kubernetes, and pipeline secrets.
Even short exposure windows can cascade through unpinned dependencies and CI caches.
-
terminal
Search code, images, and runners for LiteLLM==1.82.7 or 1.82.8; if found, rotate all reachable secrets and inspect for privileged pods and unknown systemd services.
-
terminal
Exercise your dependency controls: pin safe LiteLLM versions (<=1.82.6), enforce lockfiles, and validate supply-chain gates in CI on a throwaway branch.
Legacy codebase integration strategies...
- 01.
Freeze and audit transitive dependencies; check in lockfiles and configure internal PyPI mirrors with quarantine before promotion.
- 02.
Purge and rebuild CI caches; rotate org-wide cloud keys, CI tokens, and K8s secrets that could have been present on any runner.
Fresh architecture paradigms...
- 01.
Design for blast-radius limits: short‑lived, scoped credentials (OIDC STS), secret zero‑trust, and immutable CI images.
- 02.
Adopt strict version pinning with lockfiles from day one and automate SBOM/provenance checks in the pipeline.