Mar 24, 2026
LiteLLM got hit by a supply chain compromise. If you updated, treat the machine as burned.
LiteLLM versions 1.82.7 and 1.82.8 were publicly flagged as compromised on March 24, 2026. The public record points to credential theft, automatic execution via a .pth file on 1.82.8, PyPI quarantine, and a maintainer-account compromise ugly enough that any affected machine should be treated like an incident-response problem, not a package-bump problem.