# litellm: Credential Stealer Hidden in PyPI Wheel

Malicious litellm 1.82.7/1.82.8 PyPI releases harvested credentials, exfiltrated AES-256/RSA-4096 encrypted data to models.litellm.cloud, and installed a persistent C2 backdoor.

- Payout: Real-world hack
- Severity: critical
- Program: litellm
- Analysis by: StepSecurity
- Disclosed: 2026-03-28
- Write-up quality: 8/10
- Original: https://www.stepsecurity.io/blog/litellm-credential-stealer-hidden-in-pypi-wheel
- Library page: https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-litellm-credential-stealer-hidden-in-pypi-wheel
- Tags: area:oss domain:oss impact:data-leak impact:internal-access kind:incident platform:threat-intel sev:critical tech:aws tech:kubernetes tech:python technique:reverse-engineering technique:source-review vuln:secrets-leak

**Target:** PyPI package (litellm) / Python site-packages .pth and proxy_server.py
**Root cause:** Publishing credential or CI/CD pipeline compromise (possibly via previously compromised Trivy) allowed injection of a malicious litellm_init.pth in 1.82.8 and a base64 payload in proxy_server.py in 1.82.7, both executing on Python startup/import.
**Steps:**
1. `pip install litellm==1.82.8` writes `litellm_init.pth` to site-packages; Python site module executes its `import os, subprocess, sys; subprocess.Popen([sys.executable, "-c", "import base64; exec(base64.b64decode('...'))"])` line on every interpreter startup
2. Decoded payload runs recon (`hostname; pwd; whoami; uname -a; ip addr; printenv`) and harvests SSH keys, ~/.aws, ~/.kube, gcloud/azure creds, .env files, shell history, crypto wallets, TLS keys
3. Harvester queries IMDS `169.254.169.254` for IAM creds, signs SigV4 calls to Secrets Manager `ListSecrets`/`GetSecretValue` and SSM `DescribeParameters`
4. If K8s SA token present, calls `/api/v1/secrets` and `/api/v1/namespaces/<ns>/secrets`
5. Encrypts collected data: `openssl enc -aes-256-cbc -pass file:session.key -pbkdf2`, wraps session key with RSA-4096 OAEP, packs `tpcp.tar.gz`
6. POSTs to `https://models.litellm.cloud/` with `X-Filename: tpcp.tar.gz`
7. Drops `~/.config/sysmon/sysmon.py` and systemd user service 'System Telemetry Service' polling `https://checkmarx.zone/raw` every ~50 min, downloading and executing arbitrary binaries
8. Deploys privileged pod `node-setup-<node>` in kube-system with hostPID/hostNetwork, hostPath `/`, tolerations Exists, writing sysmon.py to `/host/root/.config/sysmon/` and enabling via `chroot /host systemctl`
**How found:** Static analysis of both PyPI releases: noticed litellm_init.pth registered in RECORD with valid SHA-256, decoded the base64 blob, found identical RSA public key and exfil endpoint across 1.82.7 and 1.82.8; validated via controlled GitHub Actions run with Harden Runner, which flagged IMDS and models.litellm.cloud connections.
**Exploitation:** Attacker compromised the litellm publishing pipeline and shipped two malicious releases. On install/import, the payload silently harvests all reachable credentials, uses live AWS/K8s API calls to pull secrets, encrypts with hybrid AES-256/RSA-4096, and exfiltrates to a typosquatted domain. Concurrently installs a systemd user-service C2 implant and, where K8s tokens permit, deploys privileged pods across all nodes to backdoor host OSes.
**Escalation:** Chains from a single Python import to full host credential theft, then to cluster-wide node compromise via privileged pods with hostPath / and Exists tolerations, plus persistent arbitrary-code C2 via checkmarx.zone.
**Insight:** Audit .pth files in site-packages and RECORD entries for unexpected files — .pth `import` lines execute on every Python startup and are missed by many scanners; also diff base64 blobs at module top-level imports in proxy/server entrypoints.