GCVE-VVD-OSM-2026-183

This package has been compromised by TeamPCP via a GitHub account takeover of the CEO of the company that maintains litellm. Do not install or use this package. We have verified that 1.82.7 and 1.82.8 are malicious. Other versions appear fine. This malware is a sophisticated supply chain attack that automatically executes whenever Python starts on an infected system through a malicious .pth file. Once running, it performs comprehensive credential theft by systematically scanning the entire filesystem for sensitive data including SSH private keys, AWS/GCP/Azure cloud credentials, Kubernetes secrets, cryptocurrency wallets (Bitcoin, Ethereum, Solana, and 8+ other platforms), database passwords, API keys, environment variables, SSL certificates, git credentials, and CI/CD secrets. It also queries cloud metadata services (169.254.169.254) to steal temporary credentials and attempts to takeover Kubernetes clusters by deploying privileged pods that escape to the host system. After collecting all this data, the malware encrypts it using hybrid encryption (AES-256 for the data, RSA-2048 for the session key) and exfiltrates everything to its command-and-control server at models.litellm.cloud via HTTPS POST. To maintain persistent access, it installs a systemd service disguised as "System Telemetry Service" that automatically restarts if killed and can receive additional commands from the attackers. The attack targets cloud infrastructure, cryptocurrency assets, and enterprise secrets with the goal of complete system compromise, making it one of the most comprehensive credential theft operations in recent Python supply chain attacks.