Malicious LiteLLM PyPI Versions Steal Cloud Credentials and Kubernetes Secrets
Summary
The article says compromised LiteLLM versions 1.82.7 and 1.82.8 execute malicious code that steals credentials and Kubernetes secrets, and recommends removing the package, investigating indicators, blocking listed domains, and rotating credentials.
Key points
- The article identifies LiteLLM PyPI versions 1.82.7 and 1.82.8 as compromised after an alleged maintainer-account hijack.
- It says the payload can run when Python starts, even if the affected library is not imported, and caused host crashes through an accidental process loop.
- The malware allegedly collects AWS, GCP, and Azure credentials, SSH keys, environment variables, and .env files.
- The article describes Kubernetes service-account token theft, cross-namespace secret access, container escape, and host persistence.
- Reported indicators include litellm_init.pth, sysmon.service, /tmp/pglog, /tmp/.pg_state, and privileged node-setup-* pods in kube-system.
- Recommended response includes removing the package, clearing caches, investigating indicators, blocking outbound traffic to listed domains, and rotating exposed credentials.
Article Details
- Attack Vectors
- Compromised litellm PyPI versions 1.82.7 and 1.82.8 execute malicious code when the Python interpreter starts, even if the library is not imported.
- The payload searches environment variables and .env files for credentials, queries cloud metadata, and uses Kubernetes service-account tokens to access secrets across namespaces.
- The article reports container escape and installation of persistent backdoors on host nodes.
- The payload encrypts data and sends it to an attacker-controlled server.
- Defensive Notes
- Remove the compromised package and clear package-manager caches; investigate environments updated on or after March 24, 2026.
- Rotate SSH keys, cloud credentials, and database passwords; review Kubernetes service-account tokens and cluster secrets.
- Search for litellm_init.pth, unauthorized sysmon.service daemons, /tmp/pglog, /tmp/.pg_state, and anomalous privileged node-setup-* pods in the kube-system namespace.
- Block outbound traffic to the listed domains checkmarx.zone and models.litellm.cloud.
- Pin dependencies to cryptographic hashes and quarantine or test new package releases before deployment.
- Scan container images during builds and monitor runtime behavior for credential access, Kubernetes-token reads, and unauthorized daemon installation.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | checkmarx[.]zone | Domain the article identifies as an attacker-controlled server contacted by the payload. |
| DOMAIN | models[.]litellm[.]cloud | Domain listed in the article's IOC directives for blocking outbound traffic. |
MITRE ATT&CK
T1059.006 · PythonThe malicious code executes through Python interpreter startup, without requiring the compromised library to be imported.T1486 · Data Encrypted for ImpactThe article says the payload encrypts data.T1552.001 · Credentials In FilesThe payload searches .env files for credentials.T1552.005 · Cloud Instance Metadata APIThe payload queries internal cloud metadata to obtain or misuse instance-role credentials.T1611 · Escape to HostThe article reports the payload escaping a Kubernetes pod to install backdoors on host nodes.
People
Vendors
Amazon Web ServicesIt casts a massive net to extract AWS, GCP, and Azure configs, and actively queries your internal cloud metadata to hijack instance roles.AzureIt casts a massive net to extract AWS, GCP, and Azure configs, and actively queries your internal cloud metadata to hijack instance roles.GCPIt casts a massive net to extract AWS, GCP, and Azure configs, and actively queries your internal cloud metadata to hijack instance roles.Trend MicroTrend Micro: Research Paper - Unleashing Chaos: Real-World Threats Hidden in the DevOps Minefield
Products
Container SecurityThat is where Container Security and Vision One take over.KubernetesLitellm PyPI breach explained: malicious versions steal cloud credentials, SSH keys, and Kubernetes secrets.LiteLLMYour AI Stack Just Handed Over Your Root Keys: Inside the litellm PyPI BreachPyPIYour AI Stack Just Handed Over Your Root Keys: Inside the litellm PyPI BreachTrendAI Cloud Risk and Exposure Management (CREM)This is exactly why TrendAI Cloud Risk and Exposure Management (CREM) exists.TrendAI Code SecurityTrendAI Code Security catches the malicious payload before it detonates by scanning your container images during the build phase and flagging the compromised library.Vision OneThat is where Container Security and Vision One take over.