Assessing the LiteLLM Supply Chain Attack: Techniques and Mitigation Strategies

Cyber incidents increasingly stem from supply chain attacks, with methods evolving rapidly. Recently, the focus has shifted to compromised libraries that developers rely on, allowing attackers to infiltrate systems undetected. An alarming case unfolded in March 2026 when malicious code was introduced into the Python library LiteLLM, a widely used multifunctional gateway for AI agents, through two compromised versions uploaded to the PyPI repository.

Attackers exploited the distribution channels of LiteLLM, leading to the unauthorized release of versions litellm==1.82.7 and litellm==1.82.8. Each version contained hidden malicious code, specifically targeting sensitive database configurations, AWS, NPM, and Kubernetes secrets. This breach exemplifies the potential for widespread compromise when popular libraries are targeted.

Repository Compromise Overview

Beginning on March 24, 2026, the malicious versions were made available through the PyPI repository. The attack embedded malicious scripts within proxy_server.py of version 1.82.7 and introduced litellm_init.pth in version 1.82.8, marking a calculated approach to deploy the malware.

Technical Breakdown of the Malicious Code

Both compromised versions executed similar malicious payloads, albeit through different mechanisms. The code embedded in proxy_server.py activated upon importing the proxy functionality, whereas the addition of the .pth file allowed the malicious script to run every time the Python interpreter initialized.

The unauthorized code base64-encoded a payload that executed another script—also encoded in Base64—without saving it to disk. This script generated output that was encrypted using AES-256-CBC. An encrypted key was then created with a public RSA key and sent to the attackers' remote server in a compressed file.

Upon execution, the payload conducted recursive scans of various directories in the victim's system, gathering file contents, system information, and key configurations, focusing on:

• SSH keys
• GIT accounts
• .env files
• Details regarding AWS, Kubernetes, and database configurations
• Helm, Terraform, and CI-related files
• TLS keys and certificates

This malware uniquely aims not only to extract files from disk but also to retrieve runtime secrets from cloud environments, tapping into the AWS Instance Metadata Service (IMDS) for credentials and metadata. Moreover, it seeks configurations tied to crypto wallets and communications tools like Slack and Discord, indicating multi-faceted infiltration strategies.

Establishing Persistence

Once sufficient access is secured, the malware formulates a privileged Kubernetes pod by enabling securityContext.privileged=true. This allows actions at the node level, evading typical container restrictions. In a critical escalation, the malware saves a second-stage script named sysmon.py to the Kubernetes node’s file system, allowing persistent access through the systemd service.

Without Kubernetes, it registers the sysmon.py script for local persistence in user directories, maintaining its touchpoint on potentially infected systems.

NodeJS Variant Discovered

Further analysis uncovered trojanized Checkmarx software extensions:
ast-results 2.53.0 and cx-dev-assist 1.7.0—both compromised to deliver a NodeJS version of the malware. This attack variant differs in that it only ensures persistence in the immediate environment without raising privileges to the Kubernetes level. The attack’s strategies reflect local persistence within the boundaries it occupies.

The implications of the compromised Checkmarx extensions are severe, as they can expose not only project files but also critical tokens and configuration files within development projects.

Global Victimology and Impact Assessment

Analysis of the attack's ramifications indicates that it affected numerous organizations worldwide. Reports revealed significant infection attempts primarily from regions including Russia, China, Brazil, the Netherlands, and the UAE. Each attack highlights the global scale at which supply chain vulnerabilities manifest.

Conclusions Drawn from the Incident

The LiteLLM case underscores the dual threat posed by data theft and the compromise of essential infrastructure. The attack effectively targets sensitive data in local systems, exploitable cloud secrets, and critical Kubernetes configurations, allowing attackers to expand their control from a singular Python environment to broader infrastructures. Security professionals must recognize the multifaceted nature of such threats to develop comprehensive defensive postures.

Preventive Measures and Recommendations

To mitigate risks associated with similar attacks, incorporating specialized monitoring solutions focused on open-source components is essential. Kaspersky offers services providing real-time updates on compromised packages, aiding developers in securing their supply chains.

Utilizing home security solutions like Kaspersky Premium helps ensure personal devices are secured against infection threats. For corporate environments, deploying a comprehensive solution like Kaspersky NEXT equips organizations with significant visibility into threat landscapes with advanced protection tools.

Post-incident, organizations that utilized compromised LiteLLM versions should execute immediate remediation steps including:

• Conduct comprehensive system scans with trusted security tools.
• Rotate all possibly compromised credentials, including API keys and service tokens.
• Inspect for indicators of compromise in both hosts and Kubernetes clusters for unauthorized files and pods.
• Clear cache and audit dependencies to revert to clean module versions.
• Search for any signs of infection within the system or network.

Indicators of Compromise for Further Monitoring:

Malicious URLs:
models[.]litellm[.]cloud
checkmarx[.]zone

Infected Packages:
85ED77A21B88CAE721F369FA6B7BBBA3
2E3A4412A7A487B32C5715167C755D08
0FCCC8E3A03896F45726203074AE225D

Suspicious Scripts:
F5560871F6002982A6A2CC0B3EE739F7
CDE4951BEE7E28AC8A29D33D34A41AE5
05BACBE163EF0393C2416CBD05E45E74