What Happened: The Attack at a Glance


On March 24, 2026, two versions of LiteLLM — the wildly popular Python library that routes API calls to OpenAI, Anthropic, Google, and 100+ other large language model providers — were published to PyPI carrying a sophisticated, multi-stage credential-stealing payload. LiteLLM, with more than 40,000 GitHub...