Malicious LiteLLM Versions on PyPI Downloaded Nearly 47,000 Times in 46 Minutes

Attackers released two harmful versions of LiteLLM on the Python Package Index (PyPI) on March 24. According to NS3.AI, FutureSearch reported that these versions were downloaded 46,996 times within just 46 minutes. Version 1.82.8 included a .pth file that executed with every Python startup. The payload was designed to search for wallet files, Solana validator data, and cloud credentials. LiteLLM advised that installations made during this period, which involved unpinned transitive dependencies, should be considered potentially compromised.