LiteLLM PyPI Releases 1.82.7 and 1.82.8 Contain Credential-Stealing Malware

Summary

StepSecurity’s analysis found LiteLLM 1.82.7 and 1.82.8 packages contain credential-stealing payloads that encrypt and attempt to exfiltrate secrets, install persistent backdoors, and could spread across Kubernetes nodes; it recommends rotating exposed credentials.

Key points

StepSecurity found that version 1.82.8 uses a malicious litellm_init.pth file executed at Python startup, while 1.82.7 embeds the payload in proxy_server.py and runs it when the proxy module is imported or started.
The payload searches for SSH keys, cloud credentials, environment files, CI/CD secrets, and Kubernetes credentials; it also uses discovered AWS credentials and Kubernetes tokens to query secret stores and Kubernetes APIs.
Collected data is encrypted with AES-256-CBC, with the session key wrapped using RSA-4096; the malware attempts to send the archive to hxxps://models[.]litellm[.]cloud.
The payload installs a systemd user service running sysmon.py, which polls hxxps://checkmarx[.]zone/raw about every 50 minutes and can download and execute binaries.
With a Kubernetes service-account token that permits pod creation, the malware can deploy privileged pods across cluster nodes and install a backdoor on the hosts.
In controlled GitHub Actions testing, StepSecurity observed requests to the cloud metadata service and the exfiltration endpoint; recursive execution of the .pth payload can also exhaust runner resources.
StepSecurity recommends treating systems that had either release installed as compromised, rotating accessible credentials, checking for persistence and Kubernetes pods, and reinstalling a version confirmed clean.

Article Details

Attack Vectors: The article reports that litellm versions 1.82.7 and 1.82.8 were compromised. Version 1.82.8 contains a malicious .pth file that runs at Python interpreter startup; version 1.82.7 embeds the payload in the proxy server module and runs it when that module is imported or the proxy is started.
The payload collects local credentials and secrets, including SSH keys, cloud credentials, environment files, and Kubernetes secrets. It also uses discovered AWS credentials to query Secrets Manager and SSM Parameter Store, and a Kubernetes service account token to enumerate Kubernetes secrets.
Collected data is archived, encrypted with AES-256 and an RSA-4096 public key, and sent to the attacker-controlled exfiltration endpoint.
A persistence implant is installed as a systemd user service. It polls a C2 endpoint and downloads and executes a binary from a URL supplied by that endpoint.
If a usable Kubernetes service account token is found, the payload deploys privileged pods across cluster nodes, mounts the host filesystem, and installs the backdoor on the host operating systems.
The article says TeamPCP had previously compromised Trivy and suggests it may have used that foothold to compromise the LiteLLM CI/CD pipeline; this proposed connection is not confirmed.
Defensive Notes: Treat systems where litellm 1.82.7 or 1.82.8 was installed as compromised. Rotate all credentials accessible to those systems, including CI/CD secrets and values retrieved from AWS Secrets Manager or SSM Parameter Store.
Check for litellm_init.pth and the sysmon.py persistence files and systemd user service. The article says the .pth file indicates the compromised package was installed; the persistence files indicate the malware ran.
In Kubernetes environments, check kube-system for node-setup pods and inspect every node for the installed backdoor. Delete matching malicious pods and do not assume removing only the infected container is sufficient.
Audit outbound network logs for connections to the listed exfiltration and C2 URLs. Upgrade to a version confirmed clean and verify that litellm_init.pth is absent before reinstalling.
The article says Harden Runner allowed-endpoint policies could block the outbound connection to the exfiltration endpoint and alert on the anomalous request.

Indicators of compromise

Type	Indicator	Context
URL	`hxxps[:]//checkmarx[.]zone/raw`	C2 endpoint polled by the persistence implant for URLs from which it downloads and executes binaries.
URL	`hxxps[:]//models[.]litellm[.]cloud/`	Attacker-controlled exfiltration endpoint; the compromised package POSTs the encrypted credential archive here.