LiteLLM Supply Chain Attack: One 'pip install' Steals All Keys; Karpathy Calls It 'Scariest Thing in Software'

AI agent development tool LiteLLM was hit by a supply chain attack, with OpenAI co-founder Andrej Karpathy calling it 'the scariest thing in modern software'. The tool has 97 million monthly downloads, and affected versions v1.82.7 and v1.82.8 have been removed from PyPI.

A single 'pip install litellm' could steal all sensitive info like SSH keys, cloud credentials, and environment variables, while malicious code implants persistent backdoors. Projects dependent on LiteLLM (e.g., dspy) are also affected.

The attack was discovered due to an attacker's code bug causing crashes, lasting only 1 hour. LiteLLM's maintainers have deleted release tokens, and PyPA advises users to rotate all credentials immediately.