{"id":"MAL-2026-2144","summary":"Malicious code in litellm (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: google-open-source-security (6a89401cbf53902e8374fbf3b424a77bb5e5f8c437176232eab7c3237d10ecbe)\nLiteLLM was compromised through trivy security scan in a GitHub workflow.\nAttackers uploaded malicious versions of LiteLLM to PyPI. The malicious\ncode would exfiltrate sensitive secrets to an attcker controlled domain.\n\n## Source: ossf-package-analysis (c1d5a2e721c5f8b33b0530ddf98150cadf034a8cd16483e143fc2925b2cfa70c)\nThe OpenSSF Package Analysis project identified 'litellm' @ 1.82.8 (pypi) as malicious.\n\nIt is considered malicious because:\n\n- The package executes one or more commands associated with malicious behavior.\n","aliases":["PYSEC-2026-2"],"modified":"2026-03-26T10:03:39.944842Z","published":"2026-03-24T11:15:14Z","database_specific":{"iocs":{"domains":["litellm.cloud"],"urls":["https://models.litellm.cloud/"]},"malicious-packages-origins":[{"import_time":"2026-03-24T22:11:35.145201Z","sha256":"6a89401cbf53902e8374fbf3b424a77bb5e5f8c437176232eab7c3237d10ecbe","versions":["1.82.7","1.82.8"],"source":"google-open-source-security","modified_time":"2026-03-24T22:11:32Z"},{"import_time":"2026-03-26T09:50:43.996758996Z","sha256":"c1d5a2e721c5f8b33b0530ddf98150cadf034a8cd16483e143fc2925b2cfa70c","versions":["1.82.8"],"source":"ossf-package-analysis","modified_time":"2026-03-24T11:15:14Z"}]},"references":[{"type":"REPORT","url":"https://github.com/BerriAI/litellm/issues/24518"},{"type":"REPORT","url":"https://github.com/BerriAI/litellm/issues/24512"},{"type":"DISCUSSION","url":"https://news.ycombinator.com/item?id=47501729"},{"type":"ARTICLE","url":"https://www.wiz.io/blog/threes-a-crowd-teampcp-trojanizes-litellm-in-continuation-of-campaign"},{"type":"ARTICLE","url":"https://futuresearch.ai/blog/litellm-pypi-supply-chain-attack/"}],"affected":[{"package":{"name":"litellm","ecosystem":"PyPI","purl":"pkg:pypi/litellm"},"versions":["1.82.7","1.82.8"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/litellm/MAL-2026-2144.json"}}],"schema_version":"1.7.5","credits":[{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"}]}