Slow Mist Alert: LiteLLM Attacked on PyPI, Crypto Wallets and API Keys Leaked

Chief Information Security Officer of SlowMist 23pds disclosed on March 25 that the Python AI gateway library LiteLLM, with a monthly download volume of 97 million, was targeted in a supply chain attack on PyPI. The compromised versions 1.82.7 and 1.82.8 were present on the platform for at least two hours. Attackers embedded multiple malicious scripts to steal sensitive information, including cryptocurrency wallet data.

Structural Reasons Why LiteLLM Became a High-Value Target in Supply Chain Attacks

LiteLLM acts as a unified interface in the AI technology stack, supporting calls to models from major providers like OpenAI, Anthropic, and Google. Its architecture sits directly between applications and multiple AI service providers, allowing access to numerous API keys, environment variables, and sensitive configuration data.

By compromising such middleware packages, attackers can intercept sensitive credentials across local development environments, CI/CD pipelines, and cloud infrastructure without directly attacking upstream services. Investigations are currently assessing whether this attack is linked to threat groups TeamPCP and LAPSUS$, with attribution ongoing. The incident was initially reported publicly by a GitHub user and further analyzed by external researchers at Futuresearch.

Three-Layer Malicious Payload Operation Mechanism

The malicious code embedded in the affected versions employs a three-layer architecture, implemented via obfuscated Base64-encoded Python scripts:

Layer 1 (Data Exfiltration Layer): Collects local sensitive data, encrypts it with AES-256-CBC, encrypts the session key with a hardcoded RSA public key, and packages everything into tpcp.tar.gz for exfiltration to an attacker-controlled endpoint.

Layer 2 (Reconnaissance and Credential Collection Layer): Enumerates system information and environment variables, systematically extracts SSH keys, Git credentials, cloud credentials (AWS/GCP/Azure), Kubernetes configs, cryptocurrency wallet data, and CI/CD configurations. In some cases, malicious scripts actively attempt to use stolen credentials to query AWS APIs or perform Kubernetes operations.

Layer 3 (Persistence and Remote Control Layer): Writes sysmon.py to disk and sets it as a system service. Every 50 minutes, it polls an attacker-controlled endpoint, enabling persistent delivery of new malicious functionalities to infected systems.

Malicious communication domains include models.litellm.cloud and checkmarx.zone.

Mitigation Recommendations for Affected Organizations

Organizations that have installed or run compromised versions (1.82.7 or 1.82.8) of LiteLLM should treat their systems as compromised. Since the malware has persistence capabilities and may have deployed additional payloads, simply removing the package is insufficient.

Immediate actions include: rotating all exposed credentials (including AWS/GCP/Azure keys, SSH keys, and API keys); reviewing logs for suspicious outbound connections to models.litellm.cloud or checkmarx.zone; deleting known malicious files such as tpcp.tar.gz, /tmp/pglog, /tmp/.pg_state, and related sysmon.py services; and, if possible, rebuilding affected systems from known clean backups.

Frequently Asked Questions

Q: Which versions of LiteLLM are affected by this supply chain attack?
A: Versions 1.82.7 and 1.82.8 are compromised. Malicious code is embedded in proxy_server.py (affected in both versions) and litellm_init.pth (version 1.82.8). Users should verify their installed version and upgrade to the latest secure release immediately.

Q: What types of sensitive information could this attack potentially steal?
A: The malware collects SSH keys, cloud credentials (AWS/GCP/Azure), Kubernetes configs and service tokens, Git credentials, API keys from environment variables, shell history, cryptocurrency wallet data, and database passwords. The attack surface spans local development environments, CI/CD pipelines, and cloud infrastructure.

Q: How can I verify if my system has been compromised?
A: Check for indicators such as the presence of tpcp.tar.gz archives, temporary files like /tmp/pglog or /tmp/.pg_state, and persistent services related to sysmon.py. Also review outbound network logs for communications with malicious domains mentioned above.