Trojanized LiteLLM and OpenVSX Packages Steal Secrets and Target Kubernetes

Mar 27, 2026 · Original article ↗

Summary

Kaspersky analyzed malicious LiteLLM releases and OpenVSX extensions designed to harvest files and cloud credentials, target Kubernetes, and establish persistence. The packages were removed; users are advised to rotate secrets and inspect systems.

Key points

Malicious LiteLLM versions 1.82.7 and 1.82.8 were uploaded to PyPI on March 24, 2026; version 1.82.8 added a .pth file that ran code when the Python interpreter started.
The payload scanned files and configurations for SSH keys, cloud and database credentials, development secrets, TLS materials, and crypto wallet data; it also targeted AWS and ECS runtime credentials through metadata endpoints.
Collected data was encrypted, packaged, and sent to a remote server. The malware also contacted checkmarx[.]zone for additional payloads.
With sufficient access, the Python malware attempted to establish Kubernetes node persistence using a privileged pod and hostPath mount, then installed a systemd service. It also supported local persistence outside Kubernetes.
Trojanized OpenVSX extensions ast-results 2.53.0 and cx-dev-assist 1.7.0 delivered a NodeJS variant with a narrower collection scope and local persistence.
Kaspersky reported infection attempts worldwide. The compromised versions had been removed from PyPI and OpenVSX at the time of writing.
Recommended response includes rotating potentially exposed credentials, checking hosts and clusters for suspicious files and pods, and auditing and replacing affected packages.

Article Details

Attack Vectors: Attackers uploaded trojanized LiteLLM versions 1.82.7 and 1.82.8 to PyPI; version 1.82.7 embedded malicious code in proxy_server.py, while version 1.82.8 added litellm_init.pth for execution when the Python interpreter starts.
Trojanized OpenVSX extensions ast-results 2.53.0 and cx-dev-assist 1.7.0 delivered a NodeJS malware variant.
Base64-encoded Python payloads collected local files, configurations, credentials, and crypto wallet data; the malware also attempted to retrieve temporary credentials from AWS IMDS and ECS metadata endpoints.
The Python payload attempted Kubernetes persistence by creating a privileged pod with a hostPath mount, then registering sysmon.py as a systemd service. It also established local systemd persistence when Kubernetes was absent.
The malware encrypted collected output and a key, packaged them in tpcp.tar.gz, and sent the archive to a remote server. A later-stage script contacted a C2 endpoint for payload updates.
Defensive Notes: The article reports that the compromised LiteLLM versions had been removed from PyPI and OpenVSX at the time of writing.
Recommended response includes scanning systems, rotating potentially compromised credentials and secrets, checking hosts and Kubernetes clusters for sysmon.py and suspicious pods, clearing caches, auditing PyPI modules, and rolling back to clean versions.
Check systems and networks for the indicators of compromise listed in the article.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`checkmarx[.]zone`	Attacker C2 domain used to retrieve links to additional payloads and host a NodeJS payload.
DOMAIN	`models[.]litellm[.]cloud`	Listed by the article as C2 and malicious hosting infrastructure.
MD5	`05bacbe163ef0393c2416cbd05e45e74`	Hash listed for a malicious script.
MD5	`0fccc8e3a03896f45726203074ae225d`	Hash listed for an infected package.
MD5	`2e3a4412a7a487b32c5715167c755d08`	Hash listed for an infected package.
MD5	`85ed77a21b88cae721f369fa6b7bbba3`	Hash listed for an infected package.
MD5	`cde4951bee7e28ac8a29d33d34a41ae5`	Hash listed for a malicious script.
MD5	`f5560871f6002982a6a2cc0b3ee739f7`	Hash listed for a malicious script.