LiteLLM

registryPyPI

package namelitellm

maintainerBerriAI

LiteLLM is a unified Python client that translates requests across 100+ LLM providers (OpenAI, Anthropic, Bedrock, Vertex AI, and others) behind a single API surface. It is used as the LLM gateway layer in many production AI agent systems and autonomous pipelines. The package intercepts every prompt, response, and tool call that passes through the agent stack.

api usage

Checking LiteLLM

litellm 1.82.7 is a confirmed malicious publish. Use it to test your integration end-to-end. The example response below shows what Attestd returns for a compromised version on the watchlist (supply_chain_monitored: true).

bash

curl "https://api.attestd.io/v1/check?product=litellm&version=1.67.0" \
  -H "Authorization: Bearer YOUR_API_KEY"

example response

json

{
  "product": "litellm",
  "version": "1.82.7",
  "supported": true,
  "risk_state": "none",
  "risk_factors": [],
  "actively_exploited": false,
  "remote_exploitable": false,
  "authentication_required": false,
  "patch_available": false,
  "fixed_version": null,
  "confidence": 1,
  "cve_ids": [],
  "cves": null,
  "max_epss": null,
  "typosquat": null,
  "supply_chain_monitored": true,
  "supply_chain": {
    "compromised": true,
    "sources": [
      "osv",
      "registry"
    ],
    "malware_type": "malicious_package",
    "description": "TeamPCP supply chain attack: a malicious version contained a credential stealer in proxy_server.py targeting LLM provider API keys. Published at 10:39 UTC and removed within six hours after community detection.",
    "advisory_url": "https://docs.litellm.ai/blog/security-update-march-2026",
    "compromised_at": "2026-03-24T10:39:00Z",
    "removed_at": "2026-03-24T16:00:00Z"
  },
  "last_updated": "2026-05-01T00:00:00Z"
}

attack surface

Why this package is monitored

LiteLLM sits on the request path for every provider call, so it sees plaintext prompts, tool results, and provider responses before application filters run. Tampering here can siphon conversation history and any API keys carried in system prompts or gateway config.

Attestd monitors litellm using the following detection sources:

registry

Manually curated advisories in the Attestd registry, verified by a human analyst. Confidence 1.0.

osv

OSV.dev malicious-package advisories with IDs prefixed MAL-. Confidence 0.95.

pypi_yank

Versions yanked on PyPI with a security-related yanked_reason annotation. Confidence 0.80.

known incident

Confirmed malicious publish

version	`1.82.7`
date	2026-03-24
description	TeamPCP supply chain attack: a malicious version contained a credential stealer in proxy_server.py targeting LLM provider API keys. Published at 10:39 UTC and removed within six hours after community detection.
sources	`osvregistry`
advisory	https://docs.litellm.ai/blog/security-update-march-2026

Supply chain overview Detection Ledger All PyPI packages LangChain OpenAI SDK (Python)Anthropic SDK (Python)Response fields