Brief but Dangerous: Malicious LiteLLM Package May Have Hit 2,100+ Organisations

Two malicious versions of LiteLLM, a widely used tool for interacting with AI models, were briefly published on the PyPI software repository in March. Although the tainted releases were live for only about 40 minutes, they contained code designed to harvest sensitive credentials — including cloud access keys, SSH keys, Kubernetes tokens, and database passwords — from any system that installed them.

Threat intelligence firm CloudSEK has now analysed a dataset of roughly 434,000 files captured by the attackers during this window. Based on this data, CloudSEK estimates that more than 2,100 organisations may have had sensitive credentials exposed, even though the malicious package was available for a very short time. This highlights how quickly damage can be done in modern software supply chains, where a single compromised package version can silently collect secrets before anyone notices.

The incident is a reminder that open-source software repositories, while essential to modern development, are attractive targets for attackers seeking to insert malicious code into widely used tools. Even brief exposure windows can result in significant credential theft if automated systems pull in new package versions without review.