LiteLLM PyPI has been compromised an hour ago, do not update

Posted by Bullhorn9268 on Tuesday March 24, 2026 @08:07AM
from the futuresearch.ai dept.

https://futuresearch.ai/blog/litellm-pypi-supply-chain-attack/

( 6 comments | 8 points | on HN )

Re:LiteLLM PyPI has been compromised an hour ago, do not update by parad0x0n on Tuesday March 24, 2026 @08:14AM (#47501506)

Thank you!

[ Parent | on HN ]

Re:LiteLLM PyPI has been compromised an hour ago, do not update by rgambee on Tuesday March 24, 2026 @08:19AM (#47501567)

It's also been reported to their GitHub: https://github.com/BerriAI/litellm/issues/24512

[ Parent | on HN ]

Re:LiteLLM PyPI has been compromised an hour ago, do not update by Bullhorn9268 on Tuesday March 24, 2026 @08:20AM (#47501569)

yeah, updated in the post

[ Parent | on HN ]

Re:LiteLLM PyPI has been compromised an hour ago, do not update by rgambee on Tuesday March 24, 2026 @09:24AM (#47502237)

Seems that the GitHub account of one of the maintainers has been fully compromised. They closed the GitHub issue for this problem. And all their personal repos have been edited to say "teampcp owns BerriAI". Here's one example: https://github.com/krrishdholakia/blackjack_python/commit/8f...

[ Parent | on HN ]

Re:LiteLLM PyPI has been compromised an hour ago, do not update by darkteflon on Tuesday March 24, 2026 @03:50PM (#47508084)

We recently switched to pnpm, in part to guard against supply chain attacks (https://pnpm.io/supply-chain-security).

Reading this got me wondering whether uv has something similar, and indeed it does appear to (https://docs.astral.sh/uv/reference/settings/#exclude-newer)

[ Parent | on HN ]

Re:LiteLLM PyPI has been compromised an hour ago, do not update by nateb2022 on Wednesday March 25, 2026 @04:57PM (#47523154)

Wherever practical, I also recommend using devcontainers, so that in addition to breaking supply chain security, large-scale damage would require an unpatched sandbox exploit too.

[ Parent | on HN ]