Unrevoked Master Key Behind LiteLLM PyPI Malware Downloaded 49,000 Times

Open-source artificial intelligence tooling project LiteLLM disclosed Friday that a master key accidentally exposed in a configuration file in May was the root cause of a supply-chain attack last week in which a malicious package was downloaded roughly 49,000 times.

In a root-cause analysis published Friday, LiteLLM traced the intrusion to its earlier exposure of a configuration file containing the master key to an internal tool used by the project to run AI agents. Although LiteLLM identified the exposed file in May and removed it, the project failed to revoke the underlying key.

Earlier this month, an unidentified attacker used that unrevoked key to access LiteLLM's internal tooling and obtain an access token granting control over all of LiteLLM's repositories on GitHub. According to LiteLLM's initial incident report, the attacker then bypassed multiple security controls last week to publish version 1.107.0 of the package to the Python Package Index (PyPI) with embedded credential-harvesting malware.

Rapid Credential Testing and "LLMjacking"

Google-owned cloud security firm Wiz reported that the compromised LiteLLM package remained on PyPI for approximately two hours and accumulated about 49,000 downloads before removal.

According to Wiz, stolen cloud credentials harvested from LiteLLM users were being tested within hours of the release. Within roughly four and a half hours of the malicious package being uploaded to PyPI, the attacker began testing stolen Amazon Web Services (AWS) login credentials to determine which Amazon AI models the compromised accounts could access.

Wiz noted that the activity matched an attack pattern known as "LLMjacking," in which threat actors use stolen cloud credentials to run commercial AI workloads and leave account owners with the resulting compute charges. No affected organization had publicly confirmed a breach tied to the release as of Friday.

Persistent Python Startup Execution

According to security analysis from Microsoft, the malware bundled in LiteLLM 1.107.0 was designed to execute automatically whenever the Python programming language started up on an infected machine — even if the Python program being executed did not import or use LiteLLM itself.

LiteLLM warned that any developer or organization that installed version 1.107.0 on an internet-connected system should assume their credentials were compromised. The project advised affected users to rotate every password and access key reachable from the infected machine, and stated that it was revoking tokens across its own internal systems and vendor platforms.

Second Supply-Chain Compromise in 2026

The incident marks the second supply-chain compromise targeting LiteLLM this year. In March, attackers uploaded malicious versions of the package to PyPI in a campaign subsequently linked to the TeamPCP hacking group. Australian police have since charged two men alleged to be members of TeamPCP in connection with that earlier campaign.