Possibly the most alarming malicious code injection incident targeting open-source AI services recently: a popular Python library with over 9.5 million monthly downloads, considered the “Swiss Army knife” for AI model invocations: LiteLLM reportedly suffered a breachAccording to emergency reports from the security community and GitHub, attackers successfully took over LiteLLM’s administration rights on PyPI (Python Package Index) and released malicious versions v1.82.7 and v1.82.8. The organization behind this attack is called TeamPCPThe organization has recently launched similar attacks against well-known security scanning tools such as Trivy and KICS. This time, they have set their sights on AI infrastructure, attempting to infiltrate developers’ machines to steal API keys and sensitive credentials for all major AI models (such as OpenAI, Anthropic, and AWS Bedrock).
Open-source Library LiteLLM, With Over 95 Million Monthly Downloads, Found Injected with Malicious Code
The technical detail that shocked cybersecurity experts the most about this incident was that the attackers exploited a relatively obscure but extremely dangerous mechanism within the Python environment:.pth Automatic file execution. In the malicious LiteLLM v1.82.8 version, an attacker injected a named litellm_init.pth the file. In Python’s operation logic, as long as something exists in the site-packages directory .pth file, which the Python interpreter automatically loads and executes each time it starts. This means victims don’t even need to write in the code import litellmAs long as that version is installed in the environment, any Python program (even python --versiontheir execution will all trigger malicious scripts
This “zero-trigger” infection mechanism allows the malicious code to operate like a ghost on developers’ machines. According to analysis, the malicious script scans for SSH keys, environment variables, AWS/GCP/Azure credentials, and even cryptocurrency wallets and shell history records. This data is encrypted by the malware using AES-256-CBC and transmitted to a carefully disguised domain. models.litellm.cloud(Note: The official domain of LiteLLM is litellm.aiAccording to preliminary estimates, over 500,000 machines worldwide could be affected, with data leakage reaching up to 300GB, including core R&D secrets from numerous tech companies and cloud service access credentials.
This attack incident quickly drew attention from AI industry leaders. Andrej Karpathy, former AI chief at Tesla and co-founder of OpenAI, issued a stern warning on social media platform X. He pointed out that the current AI development model heavily relies on layers of stacked open-source packages, with developers often executing them without review pip installKarpathy believes that future cyber attacks will no longer be limited to targeting servers, but will directly target developers’ “workstations” and “development processes.” He calls on developers to treat their development environments as “high-risk areas” and recommends conducting experiments in isolated containers or virtual machines.
Software horror: litellm PyPI supply chain attack.
Simple `pip install litellm` was enough to exfiltrate SSH keys, AWS/GCP/Azure creds, Kubernetes configs, git credentials, env vars (all your API keys), shell history, crypto wallets, SSL private keys, CI/CD secrets, database… https://t.co/aKjZJcECFq
— Andrej Karpathy (@karpathy) March 24, 2026
When BerriAI (LiteLLM’s maintainer organization) tried to post an alert on GitHub, TeamPCP went so far as to use a large number of bot accounts to spam the issue, attempting to bury the security report.
Reflection and Defense: How Can Developers Protect Themselves?
As AI tools have become widespread, many developers without traditional security backgrounds have entered the field, often overlooking fundamental supply chain security practices. In this attack, the potential losses faced by victims are difficult to estimate. Calculating based on the potential costs of enterprise cloud resource theft, the cost of remediation and credential replacement for a single company could reach hundreds of thousands of USD, with global losses estimated to be in the billions of Taiwanese dollars.
Concrete advice for developers:
- Version Pinning (Pinning Dependencies): Never use in production environments or primary development environments.
pip install package(Version not specified). Should userequirements.txtorpoetry.lockLock in specific version numbers and hash values. - Check site-packages: Developers should immediately check their Python environment directory to confirm whether it exists
litellm_init.pthIf this file exists, the machine should be considered compromised. - Complete credential rotation If the affected version was ever installed, simply deleting the files is not enough. You must immediately replace all API keys (OpenAI, Anthropic, etc.), cloud provider (AWS/GCP) credentials, and SSH keys.
- Using sandbox environment: Use Docker or DevContainers for development, and restrict containers’ network access to prevent sensitive data leaks.
Source: KOCPC Chinese