LiteLLM Got Backdoored. The Attack Vector? Their Own Security Scanner.

Every Python process on your machine just became a potential credential exfiltration endpoint if you installed the wrong version of LiteLLM today.

LiteLLM versions 1.82.7 and 1.82.8, published to PyPI on March 24, contained a malicious .pth file that executes automatically on every Python startup. Not on import. On startup. The payload dumps environment variables, queries cloud metadata endpoints (IMDS for AWS/GCP/Azure), and exfiltrates SSH keys, cloud credentials, Kubernetes configs, and crypto wallets encrypted with AES-256-CBC to a lookalike domain. LiteLLM gets 3.4 million downloads per day. 97 million monthly. The malicious versions were live for approximately three hours before PyPI quarantined them.

Here's what caught me off guard: the attack didn't start with LiteLLM. Threat actor TeamPCP first compromised Aqua Security's Trivy GitHub Action on March 19. Trivy. The vulnerability scanner. They compromised the tool that's supposed to catch this exact kind of thing, then used the CI/CD credentials it had access to in LiteLLM's pipeline to publish the poisoned packages directly to PyPI. They also hit Checkmarx and KICS GitHub Actions. Five days from scanner compromise to package backdoor.

This is a new pattern and it's ugly. Compromising a security scanner gives you access to everything it scans. It's the supply chain attack equivalent of stealing a master key from the locksmith. Your security tooling is now an attack surface, not just a defense layer.

The actionable response is already shipping across the package manager ecosystem. Simon Willison documented the cooldown features now production-ready: pnpm minimumReleaseAge (v10.16), Yarn npmMinimalAgeGate (v4.10), npm min-release-age (v11.10), and Bun's equivalent. A conservative 60-day setting would have completely blocked this attack. The malicious versions existed for 3 hours. Even a 24-hour cooldown would have saved you. Set this in your lockfile config today. Not tomorrow. Right now. If you're running LiteLLM in production, audit your CI/CD pipeline for Trivy GitHub Actions and check whether versions 1.82.7 or 1.82.8 ever touched your environment.