🔥 LiteLLM package hacked. If you work with LLM APIs, it's time to be concerned.

Yesterday, a textbook supply chain attack occurred in the Python ecosystem. The litellm package was compromised — a library with 97 million monthly downloads that currently underpins many AI projects.

A contaminated version 1.82.8 was uploaded to PyPI. It carefully included a file litellm_init.pth with a base64 payload that did one simple thing: vacuum your machine for any secrets and send them to a remote server, while self-replicating.

The list of "hijacked" items included everything the script could reach:
▫️ SSH keys
▫️ AWS/GCP/Azure credentials
▫️ Kubernetes configs
▫️ .env files (hello, your OpenAI tokens)
▫️ Terminal history and database passwords
▫️ Private SSL keys and crypto wallets

Moreover, you didn't even have to run pip install litellm to hand over your production keys. It was enough to install or update any tool that pulls it as a transitive dependency. For example, updating the popular dspy (which has litellm>=1.64.0 in its requirements) — welcome to the hacked club.

But there is one amazing nuance in this whole story.

The industry was saved from a global catastrophe because the hacker turned out to be a bad coder. 🤡
The malware was written so poorly that it caused a memory leak. Some guy was using a plugin in Cursor that pulled the latest litellm in the background. The script consumed all RAM and crashed the system. Thanks to this, the infected version was on PyPI for less than an hour before it was taken down.

If the attacker had properly tested his code, the exploit could have lingered for weeks. Half of AI startups would have shut down tomorrow due to leaked client databases and drained cloud budgets.

Andrej Karpathy shared his opinion on this: the classic development paradigm of "we build pyramids from dependency bricks" becomes a fatal vulnerability in modern realities. For decades, we were taught the academic pattern: "don't reinvent the wheel, reuse, take a ready-made library."
In today's supply chain reality, this is akin to playing Russian roulette. Every time you add a new dependency to a project, you pull its entire tree down to the tenth generation. And somewhere there might be an offended maintainer or a compromised account.

The paradigm is shifting. Instead of pulling a huge library for a couple of utility functions, it's now safer and more pragmatic to just copy-paste (or generate via LLM) the needed piece of code and lock it in your repository. 🤷‍♂️