LiteLLM Supply Chain Attack Hits 47,000 Developers in Just 46 Minutes

• What: A malicious compromise of the popular LiteLLM library on the Python Package Index (PyPI).
• Scale: 47,000 downloads of the infected package occurred during a 46-minute exposure window.
• Impact: 2,337 downstream packages were affected; 88% of those lacked the version pinning required to block the exploit.
• Risk: The malware was designed to harvest credentials and auth tokens, spreading through Kubernetes clusters.

The AI industry is reeling after a sophisticated supply chain attack targeted LiteLLM, a critical proxy library used by thousands of developers to manage various Large Language Model (LLM) APIs. On March 24, 2026, attackers successfully uploaded a compromised version of the package to PyPI, leading to 47,000 downloads in a window of just 46 minutes before the malicious files were removed.

The 46-Minute Window of "Software Horror"

The breach, which occurred at approximately 10:52 UTC on March 24, involved the release of LiteLLM version 1.82.8. According to an analysis by security researcher Daniel Hnyk, who utilized the BigQuery PyPI public dataset, the speed at which the infection spread highlights the extreme vulnerability of modern automated development workflows.

During the 46 minutes the package was live, it was pulled 47,000 times by CI/CD pipelines, automated security scanners, and individual developers. The attack centered on a malicious file named litellm_init.pth. In the Python ecosystem, .pth files are executed automatically when the site-packages directory is processed, allowing the malware to run without the user ever explicitly calling a function from the library.

Technical reports from Snyk indicate that the payload was so aggressive it inadvertently created a "fork bomb" effect. Because the malicious script spawned new Python subprocesses—which in turn triggered the execution of the .pth file again—infected systems often slowed to a crawl or crashed, which ironically served as an early warning sign for some system administrators.

A Massive Downstream Ripple Effect

The danger of the LiteLLM hack extends far beyond the initial 47,000 downloads. LiteLLM serves as a foundational "glue" for the AI ecosystem, allowing developers to switch between providers like OpenAI, Anthropic, and Google with a single interface.

Hnyk’s research identified 2,337 distinct Python packages that list LiteLLM as a dependency. Most alarmingly, 88% of these packages did not "pin" their versions (the practice of specifying an exact version like ==1.82.7). Instead, they used flexible requirements that allowed the malicious 1.82.8 update to be installed automatically.

The hacking group TeamPCP has claimed responsibility for the attack. Security firm BleepingComputer reports that the group’s primary objective was credential harvesting. By compromising the proxy that handles API keys for nearly every major LLM provider, the attackers potentially gained access to a goldmine of proprietary data and high-value compute accounts.

Impact: The "New Class" of AI Attacks

The implications for the AI industry are profound. As developers increasingly build "AI Agents" capable of executing code and managing cloud infrastructure, a compromise at the library level can grant attackers deep access to internal systems.

NVIDIA AI Director Jim Fan warned that this represents a "new class of attacks" specifically targeting the infrastructure that supports AI agents. Because LiteLLM is frequently deployed within Kubernetes clusters to manage scaling, the malware was designed to spread laterally through these clusters, seeking out authentication tokens and environment variables.

For developers, this event is a stark reminder of the "software horror" that can result from a single point of failure in the supply chain. One punchy takeaway for the community: "If you aren't pinning your dependencies, you are essentially giving a stranger the keys to your production environment every time you run a build."

What’s Next for AI Security

In the wake of the breach, the maintainers of LiteLLM and the PyPI security team acted quickly to pull the malicious version, but the damage to trust may take longer to repair. Security experts are now calling for more rigorous signing of Python packages and a move toward "frozen" environments by default in AI development.

Developers who downloaded LiteLLM on March 24 are urged to:

1. Immediately rotate all API keys (OpenAI, Anthropic, AWS, etc.).
2. Check for the existence of litellm_init.pth in their Python environment.
3. Audit Kubernetes secrets and service accounts for unauthorized access.

The industry is expected to see a shift toward more robust security scanners that can detect malicious .pth files before they are executed. As AI continues to integrate into critical business functions, the LiteLLM hack serves as a 46-minute warning that the foundation of the AI revolution is only as strong as its weakest dependency.

Sources

• Simon Willison's Weblog
• FutureSearch: LiteLLM Hack Analysis
• BleepingComputer: Popular LiteLLM PyPI package backdoored
• Snyk: How a Poisoned Security Scanner Became the Key to Backdooring LiteLLM
• Cybernews: Massive compromise hits LiteLLM
• The Decoder: LiteLLM hacked with malware spreading through Kubernetes