Major Security Breach of Critical AI Dependency Exposes Cloud Secrets

LiteLLM, an open-source library for routing requests across AI models, had two PyPI releases (v1.82.7 and v1.82.8) that contained malicious code.

Those versions were available for download for roughly six hours on March 24.

Attackers bypassed the official build process to upload malicious packages to PyPI, and the maintainer account used to publish official updates was compromised.

The malicious code searched infected systems for credentials such as environment variables, SSH keys and database passwords.

Investigators traced the breach to a compromised Trivy dependency in LiteLLM’s security-scanning pipeline; Trivy had been disclosed as compromised earlier in March, making this a supply-chain attack with a blast radius beyond the teams that installed the LLM.