LiteLLM backdoor exposed risks in AI agent gateways

Two malicious LiteLLM releases briefly appeared on PyPI after attackers stole publishing credentials through a compromised Trivy GitHub Action in the project’s CI pipeline. Version 1.82.7 was published at 10:39 UTC on March 24, 2026, followed by 1.82.8 13 minutes later. An NHS England alert said PyPI quarantined the packages at 13:38 UTC, creating a roughly 3 hours exposure window, while LiteLLM described about 40 minutes.

The backdoor targeted a high-value point in AI infrastructure. LiteLLM gateways often route calls across model providers and hold LLM API keys, cloud tokens, Kubernetes secrets, database credentials, and other sensitive material. Version 1.82.8 also added a litellm_init.pth file, which runs on every Python interpreter startup in the environment rather than waiting for LiteLLM to be imported.

Security guidance centered on treating affected systems as compromised, not merely reinstalling the package. Recommended steps included isolating machines, rotating exposed credentials, rebuilding environments instead of cleaning in place, and reviewing egress logs. The incident also reinforced the need to pin exact dependency versions, use hash-based installs, and ship gateways as immutable images rather than relying on unpinned pip installs.