GHSA-5mg7-485q-xm76
Two LiteLLM versions published containing credential harvesting malware
After an API Token exposure from an exploited trivy dependency, two new releases of litellm were uploaded to PyPI containing automatically activated malware, harvesting sensitive credentials and files, and exfiltrating to a remote API.
Anyone who has installed and run the project should assume any credentials available to litellm environment may have been exposed, and revoke/rotate thema ccordingly.
What each source reports
GitHub AdvisoriesNo score
Two LiteLLM versions published containing credential harvesting malware
After an API Token exposure from an exploited trivy dependency, two new releases of litellm were uploaded to PyPI containing automatically activated malware, harvesting sensitive credentials and files, and exfiltrating to a remote API.
Anyone who has installed and run the project should assume any credentials available to litellm environment may have been exposed, and revoke/rotate thema ccordingly.
- Record
GHSA-5mg7-485q-xm76- Weakness
- CWE-506
- Updated
- 2026-11-02
OSVNo score
Two LiteLLM versions published containing credential harvesting malware
After an API Token exposure from an exploited trivy dependency, two new releases of litellm were uploaded to PyPI containing automatically activated malware, harvesting sensitive credentials and files, and exfiltrating to a remote API.
Anyone who has installed and run the project should assume any credentials available to litellm environment may have been exposed, and revoke/rotate thema ccordingly.
- Record
GHSA-5mg7-485q-xm76- Weakness
- CWE-506
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
litellmPyPI | 1.82.7 to 1.82.8 | None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-5mg7-485q-xm76 is a vulnerability with no CVSS score yet in litellm, published March 25, 2026. No source lists public exploit code. No source names a fixed version.
References
github.com/BerriAI/litellm/issues/24518
futuresearch.ai/blog/litellm-pypi-supply-chain-attack
inspector.pypi.io/project/litellm/1.82.7/packages/79/5f/b6998d42c6ccd32d36e12661f2734602e72a576d52a51f4245aef0b20b4d/litellm-1.82.7-py3-none-any.whl/litellm/proxy/proxy_server.py
wiz.io/blog/teampcp-attack-kics-github-action
docs.litellm.ai/blog/security-update-march-2026