LiteLLM v1.82.8 PyPI Package Compromised with Credential-Stealing Malware

Summary

LiteLLM version 1.82.8, a widely used Python library for abstracting access to multiple LLM APIs, was found to contain a malicious credential stealer in its PyPI package. The attack used a base64-encoded payload hidden in a litellm_init.pth file, a Python path configuration file that executes automatically when the package is installed — meaning victims did not even need to import or run the library for the malware to activate. The compromised package was published directly to PyPI, indicating e