LiteLLMPYSEC-2026-2

Two litellm versions published containing credential harvesting malware

LiteLLM

Published Mar 24, 2026 · updated Mar 25, 2026

Unrated

No fix yet

Source advisory

After an API Token exposure from an exploited Trivy dependency,

two new releases of litellm were uploaded to PyPI containing automatically activated malware,

harvesting sensitive credentials and files, and exfiltrating to a remote API.

The malicious code runs during importing any module from the package and scans

the file system and environment variables, collecting all kinds of

sensitive data, including but not limited to private SSH keys, credentials to Git and

Docker repositories, dotenv files, tokens to Kubernetes service accounts,

databases and LDAP configuration. Also exfiltrated are multiple shell history

files and cryptowallet keys. The malware actively attempts to obtain cloud access tokens

from metadata servers and retrieve secrets stored in AWS Secrets Manager.

All collected data are sent to the domain models.litellm[.]cloud

Furthermore, the code includes a persistence mechanism by configuring

a SystemD service unit masqueraded as "System Telemetry Service" on the host it

runs on, and in a Kubernetes environment also by creating a new pod.

The persistence script then contacts hxxps://checkmarx[.]zone/raw for

further instructions.

Anyone who has installed and run the project should assume

any credentials available to litellm environment may have been exposed,

and revoke/rotate them accordingly. The affected environment should be

isolated and carefully reviewed...

Affected versions

Package	Affected	Fixed in
litellm PyPI	>= 1.82.7, <= 1.82.8	No fix yet

Details and references

After an API Token exposure from an exploited Trivy dependency, two new releases of `litellm` were uploaded to PyPI containing automatically activated malware, harvesting sensitive credentials and files, and exfiltrating to a remote API. The malicious code runs during importing any module from the package and scans the file system and environment variables, collecting all kinds of sensitive data, including but not limited to private SSH keys, credentials to Git and Docker repositories, dotenv files, tokens to Kubernetes service accounts, databases and LDAP configuration. Also exfiltrated are multiple shell history files and cryptowallet keys. The malware actively attempts to obtain cloud access tokens from metadata servers and retrieve secrets stored in AWS Secrets Manager. All collected data are sent to the domain models.litellm[.]cloud Furthermore, the code includes a persistence mechanism by configuring a SystemD service unit masqueraded as "System Telemetry Service" on the host it runs on, and in a Kubernetes environment also by creating a new pod. The persistence script then contacts hxxps://checkmarx[.]zone/raw for further instructions. Anyone who has installed and run the project should assume any credentials available to litellm environment may have been exposed, and revoke/rotate them accordingly. The affected environment should be isolated and carefully reviewed against any unexpected modifications and network traffic.

Severity from: no source yet
Also known as: MAL-2026-2144

More LiteLLM advisories

All LiteLLM

HighApr 24

LiteLLM: Server-Side Template Injection in /prompts/test endpointCVE-2026-42203fixed in 1.83.7 HighApr 8

LiteLLM: Password hash exposure and pass-the-hash authentication bypassGHSA-69x8-hrgq-fjj8fixed in 1.83.0 CriticalApr 3

LiteLLM: Authentication bypass via OIDC userinfo cache key collisionCVE-2026-35030fixed in 1.83.0 HighApr 3

LiteLLM: Privilege escalation via unrestricted proxy configuration endpointCVE-2026-35029fixed in 1.83.0 CriticalMar 25

Two LiteLLM versions published containing credential harvesting malwareGHSA-5mg7-485q-xm76no fix yet UnscoredMar 24

Malicious code in litellm (PyPI)MAL-2026-2144no fix yet