A malicious litellm_init.pth file in litellm 1.82.8 on PyPI automatically executes a credential-stealing script on Python startup, bypassing any import statement. This supply chain compromise affects anyone who installed the package, collecting SSH keys, cloud credentials, and environment variables without user interaction.

The payload is double base64-encoded and harvests system information, Git credentials, AWS/GCP/Azure tokens, Docker configs, shell histories, crypto wallets, SSL keys, and CI/CD secrets. It encrypts collected data with AES-256 and exfiltrates it via a hardcoded RSA public key to models.litellm.cloud, a domain controlled by attackers.

Users must immediately check for litellm_init.pth in site-packages, remove the package, and rotate all credentials present on affected systems. The malicious file is listed in the package's own RECORD with SHA-256 hash ceNa7wMJnNHy1kRnNCcwJaFjWX3pORLfMh7xGL8TUjg. PyPI should yank the compromised release while BerriAI audits their publishing pipeline.