litellm - ✅(Solved) Fix SECURITY: litellm 1.82.8 on PyPI contains malicious credential-stealing payload (litellm_init.pth) [3 pull requests, 7 comments, 5 participants]

litellm2026-03-24 15:16:43

ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

GitHub issue URL

Helpful · Quick feedback

GitHub stats

BerriAI/litellm#24521•Fetched 2026-04-08 01:22:53

View on GitHub

Comments

Participants

Timeline

Reactions

Author

Participants

Timeline (top)

cross-referenced ×8commented ×7subscribed ×7mentioned ×3

litellm==1.82.8 on PyPI ships a malicious .pth file (litellm_init.pth) that executes automatically on any Python invocation and steals credentials from the host machine.

Version 1.82.7 is clean. Only 1.82.8 is affected (as far as we've verified).

Root Cause

litellm==1.82.8 on PyPI ships a malicious .pth file (litellm_init.pth) that executes automatically on any Python invocation and steals credentials from the host machine.

Version 1.82.7 is clean. Only 1.82.8 is affected (as far as we've verified).

Fix Action

Fixed

Fixed by PR: Remove unused litellm dependency from pinned requirements (https://github.com/astronomer/astronomer-cosmos/pull/2499)
Fixed by PR: fix: pin litellm version to 1.81.7 (https://github.com/agntcy/agentic-apps/pull/194)

PR fix notes

PR #2499: Remove unused litellm dependency from pinned requirements

Repository: astronomer/astronomer-cosmos
Author: pankajkoti
State: open | merged: False
Link: https://github.com/astronomer/astronomer-cosmos/pull/2499

Description (problem / solution / changelog)

@pankajastro reported that litellm has been quarantined.

I believe litellm is not a direct or transitive dependency of any package in the project (at least my pipdeptree on the local hatch env says so) — it probably was an artefact from the environment where requirements were frozen and copied over from while working on PR https://github.com/astronomer/astronomer-cosmos/pull/2343.

Changed files

requirements/requirements-airflow-2.11-dbt-1.11.txt (modified, +0/-1)
requirements/requirements-airflow-2.9-dbt-1.11.txt (modified, +0/-1)
requirements/requirements-airflow-3.0-dbt-1.11.txt (modified, +0/-1)
requirements/requirements-airflow-3.1-dbt-1.11.txt (modified, +0/-1)

Code Example

python3 -m venv /tmp/litellm-test
/tmp/litellm-test/bin/pip install litellm==1.82.8
ls -la /tmp/litellm-test/lib/python*/site-packages/litellm_init.pth
# File exists — 34,628 bytes

---

python3 -m venv /tmp/litellm-clean
/tmp/litellm-clean/bin/pip install litellm==1.82.7
ls -la /tmp/litellm-clean/lib/python*/site-packages/litellm_init.pth
# File does NOT exist

RAW_BUFFERClick to expand / collapse

Summary

litellm==1.82.8 on PyPI ships a malicious .pth file (litellm_init.pth) that executes automatically on any Python invocation and steals credentials from the host machine.

Version 1.82.7 is clean. Only 1.82.8 is affected (as far as we've verified).

How we discovered this

After upgrading to litellm==1.82.8, our backend container failed to start — 100% CPU, 5GB+ RAM consumed, zero log output. Investigation revealed a .pth file injected into site-packages/ that runs arbitrary code at Python startup.

Reproduction

python3 -m venv /tmp/litellm-test
/tmp/litellm-test/bin/pip install litellm==1.82.8
ls -la /tmp/litellm-test/lib/python*/site-packages/litellm_init.pth
# File exists — 34,628 bytes

Compare with clean version:

python3 -m venv /tmp/litellm-clean
/tmp/litellm-clean/bin/pip install litellm==1.82.7
ls -la /tmp/litellm-clean/lib/python*/site-packages/litellm_init.pth
# File does NOT exist

Malicious file details

File: litellm_init.pth (installed into site-packages/)
Size: 34,628 bytes
SHA256: 71e35aef03099cd1f2d6446734273025a163597de93912df321ef118bf135238
Mechanism: Python .pth files with import statements execute automatically at interpreter startup — no explicit import of litellm is needed.

What the payload does

The .pth file contains a base64-encoded Python script that:

Gathers system info: runs hostname, whoami, uname -a, ip addr, printenv
Steals credentials from well-known paths:
- ~/.ssh/id_rsa, ~/.ssh/id_ed25519, ~/.ssh/config
- ~/.aws/credentials, ~/.aws/config
- ~/.azure/accessTokens.json
- ~/.config/gcloud/application_default_credentials.json
- ~/.docker/config.json
- ~/.gitconfig, ~/.netrc, ~/.npmrc, ~/.pypirc
Walks directories (/home, /root, /opt, /srv, /var/www, /app, /data, /var/lib, /tmp) searching for:
- .env, .env.local, .env.production, .env.development
- docker-compose.yml, .dockerenv
- config.json, credentials.json, secrets.json, service_account.json, app_settings.json
Reads sensitive system files: /etc/shadow, /etc/letsencrypt/live/*/privkey.pem
Encrypts all collected data with an embedded RSA public key
Exfiltrates the encrypted data to an external server

Impact

Any machine that installed litellm==1.82.8 — including CI/CD runners, production servers, and developer laptops — should be considered compromised.
The payload runs at Python startup, not at import litellm — so even pip install followed by any Python command in that environment triggers it.

Recommended actions

Do NOT install litellm 1.82.8 — pin to 1.82.7 or earlier
Rotate all credentials on any machine that installed 1.82.8 (AWS keys, SSH keys, API tokens, DB passwords)
Report to PyPI for package yanking
Investigate how the malicious file was introduced (compromised maintainer account? CI pipeline?)

Environment

Discovered on: 2025-03-24
Platform: Docker (python:3.11-slim) and macOS
No existing CVE found for this issue

extent analysis

Fix Plan

To fix the issue, follow these steps:

Uninstall the malicious package: Run pip uninstall litellm to remove the package.
Install a clean version: Run pip install litellm==1.82.7 to install a clean version of the package.
Remove the malicious file: Manually delete the litellm_init.pth file from the site-packages/ directory.
Rotate credentials: Rotate all credentials on any machine that installed the malicious package.

Example code to remove the malicious file:

import os
import site

# Get the site-packages directory
site_packages_dir = site.getsitepackages()[0]

# Define the path to the malicious file
malicious_file_path = os.path.join(site_packages_dir, 'litellm_init.pth')

# Check if the file exists
if os.path.exists(malicious_file_path):
    # Remove the file
    os.remove(malicious_file_path)
    print("Malicious file removed")
else:
    print("Malicious file not found")

Verification

To verify that the fix worked:

Check that the litellm_init.pth file has been removed from the site-packages/ directory.
Run pip show litellm to verify that the clean version of the package is installed.
Test your application to ensure it is working as expected.

Extra Tips

Always verify the integrity of packages before installing them.
Use a virtual environment to isolate dependencies and prevent malicious packages from affecting the system Python environment.
Regularly monitor your system for suspicious activity and rotate credentials regularly.

Vote matrix · Quick signals

Works

Did the solution work? Tap to confirm.

Easy Fix

Was it a quick fix?

Time Saver

Did it save you time?

Blocking

Was it severely blocking?

Common Issue

Are others likely hitting this too?

Flaky / Intermittent

Is it intermittent?

Verified / Reproducible

Can you reproduce it reliably?

#api #retrieval issue #search optimization #API routing #API middleware

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Data

Security

Network

Code

UI/UX

Text

System

Multimedia

Protocol

API

Engineering

litellm - ✅(Solved) Fix SECURITY: litellm 1.82.8 on PyPI contains malicious credential-stealing payload (litellm_init.pth) [3 pull requests, 7 comments, 5 participants]

Recommended Tools

GitHub issue graph ai analysis

Root Cause

Fix Action

Fixed

PR fix notes

PR #2499: Remove unused litellm dependency from pinned requirements

Description (problem / solution / changelog)

Changed files

Code Example

Summary

How we discovered this

Reproduction

Malicious file details

What the payload does

Impact

Recommended actions

Environment

extent analysis

Fix Plan

Verification

Extra Tips

Still need to ship something?

TRENDING

litellm - ✅(Solved) Fix SECURITY: litellm 1.82.8 on PyPI contains malicious credential-stealing payload (litellm_init.pth) [3 pull requests, 7 comments, 5 participants]

Recommended Tools

GitHub issue graph ai analysis

Root Cause

Fix Action

Fixed

PR fix notes

PR #2499: Remove unused litellm dependency from pinned requirements

Description (problem / solution / changelog)

Changed files

Code Example

Summary

How we discovered this

Reproduction

Malicious file details

What the payload does

Impact

Recommended actions

Environment

extent analysis

Fix Plan

Verification

Extra Tips

Still need to ship something?

RELATED_DISCOVERY

TRENDING