LiteLLM 供應鏈攻擊：你的 AI 開發環境可能已被入侵 | LiteLLM Supply Chain Attack: Your AI Dev Environment May Be Compromised

By Kit 小克 | AI Tool Observer | 2026-03-27

🇹🇼 LiteLLM 供應鏈攻擊：你的 AI 開發環境可能已被入侵

如果你最近幾天有用 pip install litellm，請立刻停下來確認版本號。2026 年 3 月 24 日，PyPI 上的 LiteLLM 套件遭受嚴重的供應鏈攻擊，影響了全球數百萬 AI 開發者的工作環境。

事件發生了什麼？

攻擊者隸屬於名為 TeamPCP 的威脅行為者，從 3 月 19 日開始，先入侵了 Trivy（一個廣泛用於 CI/CD 管線的開源安全掃描工具），竊取了維護者的 PyPI 憑證，最終在 3 月 24 日繞過官方 CI/CD 流程，直接將惡意版本上傳至 PyPI。

受影響版本：litellm 1.82.7 和 litellm 1.82.8，兩個版本在被發現後均已從 PyPI 移除。惡意版本在 PyPI 上存活約 3 小時（10:39 UTC 至 16:00 UTC），但 LiteLLM 每天下載量約 340 萬次，影響範圍仍相當廣泛。

惡意程式做了什麼？

v1.82.8 是最危險的版本：它植入了一個 litellm_init.pth 檔案，只要 Python 直譯器啟動就自動執行，不管你的程式有沒有 import litellm。惡意程式分三個階段運作：

• 資料收集：竊取 SSH 金鑰、.env 檔案、AWS/GCP/Azure 雲端憑證、Kubernetes 設定、資料庫密碼、shell 歷史記錄、CI/CD 密鑰、加密錢包檔案
• 加密外洩：以 AES-256 加密資料，再用 RSA-4096 加密金鑰，傳送至偽裝成官方域名的 models.litellm.cloud
• 持久化後門：如果偵測到 Kubernetes token，會嘗試在 kube-system 命名空間建立特權 Pod，並在 ~/.config/sysmon/sysmon.py 安裝系統級後門

如何確認你有沒有中招？

執行以下指令：

• pip show litellm — 檢查版本是否為 1.82.7 或 1.82.8
• ls ~/.config/sysmon/ — 檢查是否存在後門檔案
• Kubernetes 用戶：檢查 kube-system 中是否有 node-setup-* 命名的 Pod

中招了該怎麼做？

• 立即移除套件並清除快取：pip uninstall litellm && pip cache purge
• 輪換所有憑證：SSH 金鑰、雲端 API key、資料庫密碼、CI/CD 密鑰——全部換掉
• 移除持久化後門：刪除 ~/.config/sysmon/ 目錄與相關 systemd 服務
• 安全研究員強調：單純降版本是不夠的，必須視同完整入侵事件處理

這件事給 AI 開發者的啟示

LiteLLM 是 AI 開發生態中的核心工具，幾乎所有使用多模型 API 路由的專案都依賴它。這次攻擊凸顯了一個殘酷現實：你信任的工具鏈，本身就是攻擊面。供應鏈攻擊不再只是企業資安問題，AI 開發者的本機環境、CI/CD、Kubernetes 叢集都是目標。建議從現在起：鎖定套件版本（version pinning）、定期審查依賴、對 PyPI 套件保持最低信任原則。

好不好用，試了才知道——但這次，不先查清楚就裝，代價可能非常高。

---

🇺🇸 LiteLLM Supply Chain Attack: Your AI Dev Environment May Be Compromised

If you ran pip install litellm in the past few days without pinning a version, stop what you are doing and check your environment. On March 24, 2026, the LiteLLM package on PyPI was hit by a serious supply chain attack, affecting potentially millions of AI developers worldwide.

What Happened

A threat actor group called TeamPCP executed a multi-stage campaign starting March 19. They first compromised Trivy, a widely-used open-source security scanner integrated into LiteLLM's own CI/CD pipeline. By stealing maintainer credentials from that environment, they bypassed official release workflows and uploaded malicious packages directly to PyPI on March 24.

The compromised versions are litellm 1.82.7 and litellm 1.82.8, both now removed from PyPI. The malicious window lasted approximately 3 hours (10:39 UTC to ~16:00 UTC), but with LiteLLM seeing roughly 3.4 million downloads per day, the blast radius is significant.

What the Malware Did

Version 1.82.8 is the more dangerous one: it dropped a litellm_init.pth file that executes automatically every time Python starts — regardless of whether your code imports litellm. The payload operated in three stages:

• Credential harvesting: SSH keys, .env files, AWS/GCP/Azure cloud credentials, Kubernetes configs, database passwords, shell history, CI/CD secrets, and crypto wallet files
• Encrypted exfiltration: Data encrypted with AES-256 (key wrapped in RSA-4096), sent to attacker-controlled models.litellm.cloud — designed to look legitimate
• Persistence & lateral movement: If a Kubernetes service account token was found, it attempted to create privileged pods in kube-system and install a backdoor at ~/.config/sysmon/sysmon.py

How to Check If You Are Affected

You may be affected if you installed or upgraded LiteLLM on March 24, 2026, or run pip without version pinning. Check with:

• pip show litellm — if version is 1.82.7 or 1.82.8, you are affected
• ls ~/.config/sysmon/ — look for backdoor files
• Kubernetes users: check kube-system for pods named node-setup-*

What to Do If Affected

• Remove and purge caches: pip uninstall litellm && pip cache purge
• Rotate every credential accessible from the affected environment — SSH keys, cloud API keys, database passwords, CI/CD tokens. All of them.
• Remove persistence artifacts: delete ~/.config/sysmon/ and any associated systemd services
• Security researchers are clear: reverting the package is not sufficient remediation — treat it as a full compromise incident

The Bigger Lesson for AI Developers

LiteLLM sits at the center of most multi-model AI routing setups. This attack is a reminder that your trusted toolchain is itself an attack surface. Supply chain attacks are no longer just an enterprise concern — AI developers' local environments, CI/CD pipelines, and Kubernetes clusters are all targets. Start practicing version pinning, regularly auditing dependencies, and treating PyPI packages with minimal implicit trust.

好不好用，試了才知道 — but this time, installing without checking first could cost you everything in your environment.

Sources / 資料來源

• Supply Chain Attack in litellm 1.82.8 on PyPI — FutureSearch
• LiteLLM compromised on PyPI: TeamPCP supply chain campaign — Datadog Security Labs
• Security Update: Suspected Supply Chain Incident — LiteLLM Official
• Poisoned Security Scanner Backdooring LiteLLM — Snyk

---

AI 工具觀察站 — 每日精選 AI Agent 與工具趨勢
AI Tool Observer — Daily curated AI Agent & tool trends