LiteLLM on PyPI: two poisoned releases stole keys and cloud credentials
Identifiers: GHSA-5mg7-485q-xm76 · PYSEC-2026-2 · MAL-2026-2144
What it is
A token stolen through a compromised security scanner in LiteLLM's build pipeline was used to upload litellm 1.82.7 and 1.82.8 to PyPI on 2026-03-24. Importing them (and for 1.82.8, merely starting Python, through a .pth file) collected SSH keys, cloud and Kubernetes credentials and .env files and sent them to the attacker. The official Docker image was not affected.
Who is affected
Only these exact versions are malicious. The versions on the right are safe to move to.
| Registry | Package | Affected | Move to |
|---|---|---|---|
| PyPI | litellm | = 1.82.7 = 1.82.8 | 1.82.6, 1.83.0 |
How to check
Run one of these in your project's folder; the first two download the CLI and check its SHA-256 first:
d="$(mktemp -d)" && a="xsec-$(uname -m | sed s/arm64/aarch64/)-unknown-linux-musl.tar.gz" && curl -fsSL -o "$d/$a" "https://github.com/xtruct-col/xsec-action/releases/latest/download/$a" && curl -fsSL -o "$d/checksums.txt" "https://github.com/xtruct-col/xsec-action/releases/latest/download/checksums.txt" && (cd "$d" && grep " $a$" checksums.txt | sha256sum -c -) && tar -xzf "$d/$a" -C "$d" xsec && "$d/xsec" depsdocker run --rm -v "$PWD:/src" -w /src alpine:3.20 sh -c 'apk add -q curl && d="$(mktemp -d)" && a="xsec-$(uname -m | sed s/arm64/aarch64/)-unknown-linux-musl.tar.gz" && curl -fsSL -o "$d/$a" "https://github.com/xtruct-col/xsec-action/releases/latest/download/$a" && curl -fsSL -o "$d/checksums.txt" "https://github.com/xtruct-col/xsec-action/releases/latest/download/checksums.txt" && (cd "$d" && grep " $a$" checksums.txt | sha256sum -c -) && tar -xzf "$d/$a" -C "$d" xsec && "$d/xsec" deps'xsec depsOr look up litellm in your lockfile and compare the version with the ranges above.
How to fix it
Remove litellm and reinstall a clean version (1.82.6 or earlier, or 1.83.0 or later; 1.84.0+ also fixes CVE-2026-59822). Delete any litellm_init.pth left in site-packages, and rotate every secret the machine or CI runner had.
Sources
This list is curated by hand and kept short on purpose: it is not every known vulnerability, and a clean xsec deps does not mean no dependency has a flaw. Use your package manager's audit (npm audit, pip-audit, bundle audit) or Dependabot for the rest.