HN

Need help?
<- Back
Tell HN: Litellm 1.82.7 and 1.82.8 on PyPI are compromised

Tell HN: Litellm 1.82.7 and 1.82.8 on PyPI are compromised

dot_treo

Comments (364)

  • detente18
    LiteLLM maintainer here, this is still an evolving situation, but here's what we know so far:1. Looks like this originated from the trivvy used in our ci/cd - https://github.com/search?q=repo%3ABerriAI%2Flitellm%20trivy... https://ramimac.me/trivy-teampcp/#phase-092. If you're on the proxy docker, you were not impacted. We pin our versions in the requirements.txt3. The package is in quarantine on pypi - this blocks all downloads.We are investigating the issue, and seeing how we can harden things. I'm sorry for this.- Krrish
  • jFriedensreich
    We just can't trust dependencies and dev setups. I wanted to say "anymore" but we never could. Dev containers were never good enough, too clumsy and too little isolation. We need to start working in full sandboxes with defence in depth that have real guardrails and UIs like vm isolation + container primitives and allow lists, egress filters, seccomp, gvisor and more but with much better usability. Its the same requirements we have for agent runtimes, lets use this momentum to make our dev environments safer! In such an environment the container would crash, we see the violations, delete it and dont' have to worry about it. We should treat this as an everyday possibility not as an isolated security incident.
  • dweinstein
    https://github.com/dweinstein/canaryI made this tool for macos systems that helps detect when a package accesses something it shouldn't. it's a tiny go binary (less than 2k LOC) with no dependencies that will mount a webdav filesystem (no root) or NFS (root required) with fake secrets and send you a notification when anything accesses it. Very stupid simple. I've always really liked the canary/honeypot approach and this at least may give some folks a chance to detect (similar to like LittleSnitch) when something strange is going on!Next time the attack may not have an obvious performance issue!
  • ramimac
    This is tied to the TeamPCP activity over the last few weeks. I've been responding, and keeping an up to date timeline. I hope it might help folks catch up and contextualize this incident:https://ramimac.me/trivy-teampcp/#phase-09
  • hiciu
    Besides main issue here, and the owners account being possibly compromised as well, there's like 170+ low quality spam comments in there.I would expect better spam detection system from GitHub. This is hardly acceptable.
  • ting0
    I've been waiting for something like this to happen. It's just too easy to pull off. I've been hard-pinning all of my versions of dependencies and using older versions in any new projects I set up for a little while, because they've generally at least been around long enough to vet. But even that has its own set of risks (for example, what if I accidently pin a vulnerable version). Either that, or I fork everything, including all the deps, run LLMs over the codebase to vet everything.Even still though, we can't really trust any open-source software any more that has third party dependencies, because the chains can be so complex and long it's impossible to vet everything.It's just too easy to spam out open-source software now, which also means it's too easy to create thousands of infected repos with sophisticated and clever supply chain attacks planted deeply inside them. Ones that can be surfaced at any time, too. LLMs have compounded this risk 100x.
  • gaborbernat
    Recommend reading related blog post https://bernat.tech/posts/securing-python-supply-chain
  • rdevilla
    It will only take one agent-led compromise to get some Claude-authored underhanded C into llvm or linux or something and then we will all finally need to reflect on trusting trust at last and forevermore.
  • eoskx
    Also, not surprising that LiteLLM's SOC2 auditor was Delve. The story writes itself.
  • intothemild
    I just installed Harbor, and it instantly pegged my cpu.. i was lucky to see my processes before the system hard locked.Basically it forkbombed `grep -r rpcuser\rpcpassword` processes trying to find cryptowallets or something. I saw that they spawned from harness, and killed it.Got lucky, no backdoor installed here from what i could make out of the binary
  • cedws
    This looks like the same TeamPCP that compromised Trivy. Notice how the issue is full of bot replies. It was the same in Trivy’s case.This threat actor seems to be very quickly capitalising on stolen credentials, wouldn’t be surprised if they’re leveraging LLMs to do the bulk of the work.
  • bratao
    Look like the Founder and CTO account has been compromised. https://github.com/krrishdholakia
  • shay_ker
    A general question - how do frontier AI companies handle scenarios like this in their training data? If they train their models naively, then training data injection seems very possible and could make models silently pwn people.Do the labs label code versions with an associated CVE to label them as compromised (telling the model what NOT to do)? Do they do adversarial RL environments to teach what's good/bad? I'm very curious since it's inevitable some pwned code ends up as training data no matter what.
  • nickvec
    Looks like all of the LiteLLM CEO’s public repos have been updated with the description “teampcp owns BerriAI” https://github.com/krrishdholakia
  • f311a
    Their previous release would be easily caught by static analysis. PTH is a novel technique.Run all your new dependencies through static analysis and don't install the latest versions.I implemented static analysis for Python that detects close to 90% of such injections.https://github.com/rushter/hexora
  • syllogism
    Maintainers need to keep a wall between the package publishing and public repos. Currently what people are doing is configuring the public repo as a Trusted Publisher directly. This means you can trigger the package publication from the repo itself, and the public repo is a huge surface area.Configure the CI to make a release with the artefacts attached. Then have an entirely private repo that can't be triggered automatically as the publisher. The publisher repo fetches the artefacts and does the pypi/npm/whatever release.
  • tom_alexander
    Only tangentially related: Is there some joke/meme I'm not aware of? The github comment thread is flooded with identical comments like "Thanks, that helped!", "Thanks for the tip!", and "This was the answer I was looking for."Since they all seem positive, it doesn't seem like an attack but I thought the general etiquette for github issues was to use the emoji reactions to show support so the comment thread only contains substantive comments.
  • eoskx
    This is bad, especially from a downstream dependency perspective. DSPy and CrewAI also import LiteLLM, so you could not be using LiteLLM as a gateway, but still importing it via those libraries for agents, etc.
  • macNchz
    Was curious—good number of projects out there with an un-pinned LiteLLM dependencies in their requirements.txt (628 matches): https://github.com/search?q=path%3A*%2Frequirements.txt%20%2...or pyproject.toml (not possible to filter based on absence of a uv.lock, but at a glance it's missing from many of these): https://github.com/search?q=path%3A*%2Fpyproject.toml+%22%5C...or setup.py: https://github.com/search?q=path%3A*%2Fsetup.py+%22%5C%22lit...
  • santiagobasulto
    I blogged about this last year[0]...> ### Software Supply Chain is a Pain in the A*> On top of that, the room for vulnerabilities and supply chain attacks has increased dramaticallyAI Is not about fancy models, is about plain old Software Engineering. I strongly advised our team of "not-so-senior" devs to not use LiteLLM or LangChain or anything like that and just stick to `requests.post('...')".[0] https://sb.thoughts.ar/posts/2025/12/03/ai-is-all-about-soft...
  • abhisek
    We just analysed the payload. Technical details here: https://safedep.io/malicious-litellm-1-82-8-analysis/We are looking at similar attack vectors (pth injection), signatures etc. in other PyPI packages that we know of.
  • sschueller
    Does anyone know a good alternate project that works similarly (share multipple LLMs across a set of users)? LiteLLM has been getting worse and trying to get me to upgrade to a paid version. I also had issues with creating tokens for other users etc.
  • santiago-pl
    It looks like Trivy was compromised at least five days ago. https://www.wiz.io/blog/trivy-compromised-teampcp-supply-cha...
  • mathis-l
    CrewAI (uses litellm) pinned it to 1.82.6 (last good version) 5 hours ago but the commit message does not say anything about a potential compromise. This seems weird. Is it a coincidence? Shouldn’t users be warned about a potential compromise?https://github.com/crewAIInc/crewAI/commit/8d1edd5d65c462c3d...
  • Shank
    I wonder at what point ecosystems just force a credential rotation. Trivy and now LiteLLM have probably cleaned out a sizable number of credentials, and now it's up to each person and/or team to rotate. TeamPCP is sitting on a treasure trove of credentials and based on this, they're probably carefully mapping out what they can exploit and building payloads for each one.It would be interesting if Python, NPM, Rubygems, etc all just decided to initiate an ecosystem-wide credential reset. On one hand, it would be highly disruptive. On the other hand, it would probably stop the damage from spreading.
  • datadrivenangel
    This among with some other issues makes me consider ejecting and building my own LLM shim. The different model providers are bespoke enough even within litellm that it sometimes seems like a lot of hassle for not much benefit.Also the repo is so active that it's very hard to understand the state of issues and PRs, and the 'day 0' support for GPT-5.4-nano took over a week! Still, tough situation for the maintainers who got hacked.
  • cpburns2009
  • r2vcap
    Does the Python ecosystem have anything like pnpm’s minimumReleaseAge setting? Maybe I’m being overly paranoid, but it feels like every internet-facing ecosystem should have something like this.
  • kevml
  • mark_l_watson
    A question from a non-python-security-expert: is committing uv.lock files for specific versions, and only infrequently updating versions a reasonable practice?
  • postalcoder
    This is a brutal one. A ton of people use litellm as their gateway.
  • ps06756
    Can someone help enlighten why would someone use LiteLLM over say AWS Bedrock ? Or build a lightweight router and directly connect to the model provider?
  • noobermin
    I have to say, the long line of comments from obvious bots thanking the opener of the issue is a bit too on the nose.
  • rgambee
    Looking forward to a Veritasium video about this in the future, like the one they recently did about the xz backdoor.
  • 6thbit
    title is bit misleading.The package was directly compromised, not “by supply chain attack”.If you use the compromised package, your supply chain is compromised.
  • cpburns2009
    Looks like litellm is no longer in quarantine on PyPI, and the compromized versions (1.82.7 and 1.82.8) have been removed [1].[1]: https://pypi.org/project/litellm/#history
  • Nayjest
    Use secure and minimalistic lm-proxy instead:https://github.com/Nayjest/lm-proxy``` pip install lm-proxy ```Guys, sorry, as the author of a competing opensource product, I couldn’t resist
  • 0fflineuser
    I was running it (as a proxy) in my homelab with docker compose using the litellm/litellm:latest image https://hub.docker.com/layers/litellm/litellm/latest/images/... , I don't think this was compromised as it is from 6 months ago and I checked it is the version 1.77.I guess I am lucky as I have watchtower automatically update all my containers to the latest image every morning if there are new versions.I also just added it to my homelab this sunday, I guess that's good timing haha.
  • foota
    Somewhat unrelated, but if I have downloaded node modules in the last couple days, how should I best figure out if I've been hacked?
  • aborsy
    What is the best way to sandbox LLMs and packages in general, while being able to work on data from outside sandbox (get data in and out easily)?There is also the need for data sanitation, because the attacker could distribute compromised files through user’s data which will later be run and compromise the host.
  • wswin
    I will wait with updating anything until this whole trivy case gets cleaned up.
  • mohsen1
    If it was not spinning so many Python processes and not overwhelming the system with those (friends found out this is consuming too much CPU from the fan noise!) it would have been much more successful. So similar to xz attackit does a lot of CPU intensive work spawn background python decode embedded stage run inner collector if data collected: write attacker public key generate random AES key encrypt stolen data with AES encrypt AES key with attacker RSA pubkey tar both encrypted files POST archive to remote host
  • hmokiguess
    What’s the best way to identify a compromised machine? Check uv, conda, pip, venv, etc across the filesystem? Any handy script around?EDIT: here's what I did, would appreciate some sanity checking from someone who's more familiar with Python than I am, it's not my language of choice.find / -name "litellm_init.pth" -type f 2>/dev/nullfind / -path '/litellm-1.82..dist-info/METADATA' -exec grep -l 'Version: 1.82.[78]' {} \; 2>/dev/null
  • rgambee
    Seems that the GitHub account of one of the maintainers has been fully compromised. They closed the GitHub issue for this problem. And all their personal repos have been edited to say "teampcp owns BerriAI". Here's one example: https://github.com/krrishdholakia/blackjack_python/commit/8f...
  • dec0dedab0de
    github, pypi, npm, homebrew, cpan, etc etc. should adopt a multi-multi-factor authentication approach for releases. Maybe have it kick in as a requirement after X amount of monthly downloads.Basically, have all releases require multi-factor auth from more than one person before they go live.A single person being compromised either technically, or by being hit on the head with a wrench, should not be able to release something malicious that effects so many people.
  • arrty88
    Oooof another one. I think i will lock my deps to versions at least 3 months old.
  • xinayder
    When something like this happens, do security researchers instantly contact the hosting companies to suspend or block the domains used by the attackers?
  • ilusion
    Does this mean opencode (and other such agent harnesses that auto update) might also be compromised?
  • xunairah
    Version 1.82.7 is also compromised. It doesn't have the pth file, but the payload is still in proxy/proxy_server.py.
  • segalord
    LiteLLM has like a 1000 dependencies this is expected https://github.com/BerriAI/litellm/blob/main/requirements.tx...
  • westoque
    my takeaway from this is that it should now be MANDATORY to have an LLM do a scan on the entire codebase prior to release or artifact creation. do NOT use third party plugins for this. it's so easy to create your own github action to digest the whole codebase and inspect third party code. it costs tokens yes but it's also cached and should be negligible spend for the security it brings.
  • anon
    undefined
  • fratellobigio
    It's been quarantined on PyPI
  • mikert89
    Wow this is in a lot of software
  • dev_tools_lab
    Good reminder to pin dependency versions and verify checksums. SHA256 verification should be standard for any tool that makes network calls.
  • oncelearner
    That's a bad supply-chain attack, many folks use litellm as main gateway
  • 6thbit
    Worth exploring safeguard for some: The automatic import can be suppressed using Python interpreter’s -S option.This would also disable site import so not viable generically for everyone without testing.
  • smakosh
  • tom-blk
    Stuff like is happening too much recently. Seems like the more fast paced areas of development would benefit from a paradigm shift
  • nickspacek
    teampcp taking credit?https://github.com/krrishdholakia/blockchain/commit/556f2db3... - # blockchain - Implements a skeleton framework of how to mine using blockchain, including the consensus algorithms. + teampcp owns BerriAI
  • lightedman
    Write it yourself, fuzz/test it yourself, and build it yourself, or be forever subject to this exact issue.This was taught in the 90s. Sad to see that lesson fading away.
  • saidnooneever
    just wanna state this can litterally happen to anyone within this messy package ecosystem. maintainer seems to be doing his bestif you have tips i am sure they are welcome. snark remarks are useless. dont be a sourpuss. if you know better, help the remediation effort.
  • Ayc0
    Exactly what I needed, thanks.
  • 0123456789ABCDE
    airflow, dagster, dspy, unsloth.ai, polar
  • sudorm
    are there any timestamps available when the malicious versions were published on pypi? I can't find anything but that now the last "good" version was published on march 22.
  • tonymet
    I recommend scanning all of your projects with osv-scanner in non-blocking mode # add any dependency file patterns osv-scanner -r . as your projects mature, add osv-scanner as a blocking step to fail your installs before the code gets installed / executed.
  • cpburns2009
    LiteLLM is now in quarantine on PyPI [1]. Looks like burning a recovery token was worth it.[1]: https://pypi.org/project/litellm/
  • Aeroi
    whats up with the hundreds of bot replys on github to this?
  • johnhenry
    I've been developing an alternative to LiteLLM. Javascript. No dependencies. https://github.com/johnhenry/ai.matey/
  • otabdeveloper4
    LiteLLM is the second worst software project known to man. (First is LangChain. Third is OpenClaw.)I'm sensing a pattern here, hmm.
  • kstenerud
    We need real sandboxing. Out-of-process sandboxing, not in-process. The attacks are only going to get worse.That's why I'm building https://github.com/kstenerud/yoloai
  • faxanalysis
    This is secure bug impacting PyPi v1.82.7, v1.82.8. The idea of bracketing r-w-x mod package permissions for group id credential where litellm was installed.
  • Imustaskforhelp
    Our modern economy/software industry truly runs on egg-shells nowadays that engineers accounts are getting hacked to create a supply-chain attack all at the same time that threat actors are getting more advanced partially due to helps of LLM's.First Trivy (which got compromised twice), now LiteLLM.
  • hmokiguess
    what's up with everyone in the issue thread thanking it, is this an irony trend or is that a flex on account takeover from teampcp? this feels wild
  • rvz
    What do we have here? Unaudited software completely compromised with a fake SOC 2 and ISO 27001 certification.An actual infosec audit would have rigorously enforced basic security best practices in preventing this supply chain attack.[0] https://news.ycombinator.com/item?id=47502754
  • somehnguy
    Perhaps I'm missing something obvious - but what's up with the comments on the reported issue?Hundreds of downvoted comments like "Worked like a charm, much appreciated.", "Thanks, that helped!", and "Great explanation, thanks for sharing."
  • homanp
    How were they compromised? Phishing?
  • bfeynman
    pretty horrifying. I only use it as lightweight wrapper and will most likely move away from it entirely. Not worth the risk
  • claudiug
    LiteLLM's SOC2 auditor was Delve :))
  • gkfasdfasdf
    Someone needs to go to prison for this.
  • te_chris
    I reviewed the LiteLLM source a while back. Without wanting to be mean, it was a mess. Steered well clear.
  • danielvaughn
    I work with security researchers, so we've been on this since about an hour ago. One pain I've really come to feel is the complexity of Python environments. They've always been a pain, but in an incident like this, where you need to find whether an exact version of a package has ever been installed on your machine. All I can say is good luck.The Python ecosystem provides too many nooks and crannies for malware to hide in.
  • anon
    undefined
  • TZubiri
    Thank you for posting this, interesting.I hope that everyone's course of action will be uninstalling this package permanently, and avoiding the installation of packages similar to this.In order to reduce supply chain risk not only does a vendor (even if gratis and OS) need to be evaluated, but the advantage it provides.Exposing yourself to supply chain risk for an HTTP server dependency is natural. But exposing yourself for is-odd, or whatever this is, is not worth it.Remember that you are programmers and you can just program, you don't need a framework, you are already using the API of an LLM provider, don't put a hat on a hat, don't get killed for nothing.And even if you weren't using this specific dependency, check your deps, you might have shit like this in your requirements.txt and was merely saved by chance.An additional note is that the dev will probably post a post-mortem, what was learned, how it was fixed, maybe downplay the thing. Ignore that, the only reasonable step after this is closing a repo, but there's no incentive to do that.
  • Blackthorn
    Edit: ignore this silliness, as it sidesteps the real problem. Leaving it here because we shouldn't remove our own stupidity.It's pretty disappointing that safetensors has existed for multiple years now but people are still distributing pth files. Yes it requires more code to handle the loading and saving of models, but you'd think it would be worth it to avoid situations like this.
  • zhisme
    Am I the only one having feeling that with LLM-era we have now bigger amount of malicious software lets say parsers/fetchers of credentials/ssh/private keys? And it is easier to produce them and then include in some 3rd party open-source software? Or it is just our attention gets focused on such things?
  • chillfox
    Now I feel lucky that I switched to just using OpenRouter a year ago because LiteLLM was incredible flaky and kept causing outages.
  • cowpig
    Tried running the compromised package inside Greywall, because theoretically it should mitigate everything but in practice it just forkbombs itself?
  • iwhalen
    What is happening in this issue thread? Why are there 100+ satisfied slop comments?
  • deep_noz
    good i was too lazy to bump versions
  • anon
    undefined
  • canberkh
    helpful
  • skillflow_ai
    [dead]
  • aplomb1026
    [dead]
  • anon
    undefined
  • devnotes77
    [dead]
  • pugchat
    [dead]
  • jamiemallers
    [dead]
  • qcautomation
    [dead]
  • maxothex
    [dead]
  • matrixgard
    [dead]
  • ddactic
    [dead]
  • rsmtjohn
    [dead]
  • osaka2077
    [dead]
  • peytongreen_dev
    [flagged]
  • mitul005
    [dead]
  • dot_treo
    [dead]
  • thibault000
    [dead]
  • bustah
    [dead]
  • sy0115
    [dead]
  • bustah
    [dead]
  • hahaddmmm12x
    [flagged]
  • iamnotai666
    [dead]
  • ajoy
    Reminded me of a similar story at openSSH, wonderfully documented in a "Veritasium" episode, which was just fascinating to watch/listen. https://www.youtube.com/watch?v=aoag03mSuXQ