[D] Litellm supply chain attack and what it means for api key management

Reddit r/MachineLearning / 3/29/2026

💬 OpinionDeveloper Stack & InfrastructureSignals & Early TrendsTools & Practical Usage

共有:

Key Points

litellm versions 1.82.7 and 1.82.8 on PyPI were compromised via a malicious .pth file that executes on Python process startup and can scrape sensitive credentials without needing imports.
The stolen data reportedly includes SSH keys, AWS/GCP credentials, Kubernetes secrets, crypto wallets, and environment variables—effectively capturing many API keys and secrets.
The supply-chain compromise is believed to have entered through Trivy (a vulnerability scanner), and the attacker also obtained litellm’s PyPI publish token.
Because 2,000+ downstream packages depend on litellm, the incident could have broader reach across projects using integrations like DSPy and MLflow.
The article advises treating litellm versions above 1.82.6 as fully compromised and recommends reducing API-key sprawl (e.g., routing providers through a single key/rotatable gateway like Zenmux) to limit blast radius.

If you missed it, litellm versions 1.82.7 and 1.82.8 on pypi got compromised. malicious .pth file that runs on every python process start, no import needed. it scrapes ssh keys, aws/gcp creds, k8s secrets, crypto wallets, env vars (aka all your api keys). karpathy posted about it.

the attacker got in through trivy (a vuln scanner ironically) and stole litellm's publish token. 2000+ packages depend on litellm downstream including dspy and mlflow. the only reason anyone caught it was because the malicious code had a fork bomb bug that crashed machines.

This made me rethink how i manage model api keys. having keys for openai, anthropic, google, deepseek all sitting in .env files across projects is a massive attack surface. switched to running everything through zenmux a while back so theres only one api key to rotate if something goes wrong. not a perfect solution but at least i dont have 6 different provider keys scattered everywhere.

Run pip show litellm right now. if youre on anything above 1.82.6 treat it as full compromise.

submitted by /u/Zestyclose_Ring1123
[link] [comments]