The python package 'litellm' was compromised, leading to the inclusion of malicious code that steals credentials and installs a backdoor. The malware activates upon importing any module from the package, harvesting sensitive data such as private SSH keys, Git and Docker credentials, and cloud access tokens, and exfiltrates this data to a remote API.
| Vendor | Product | Versions |
|---|---|---|
| berriai | litellm | 1.82.7, 1.82.8 |
