LiteLLM Distributes Malware Stealing Crypto Secrets

On Mar. 24 an attacker used a compromised maintainer account to publish two malicious LiteLLM releases (1.82.7 and 1.82.8) to PyPI, with 1.82.8 planting a .pth that executed at every Python startup. The payload exfiltrated crypto wallets, Solana validator keys, SSH/cloud credentials, and Kubernetes secrets across 46,996 downloads in 46 minutes; PyPI quarantined the builds and LiteLLM removed them.