A single pip install steals all keys: Karpathy calls LiteLLM supply chain poisoning "the most terrifying thing in software"

According to 1M AI News monitoring, OpenAI founding member Andrej Karpathy posted that the supply chain attack on AI agent development tool LiteLLM is “one of the most terrifying things in modern software.” LiteLLM has 97 million downloads per month, and the infected versions v1.82.7 and v1.82.8 have been removed from PyPI.

Just one command, pip install litellm, is enough to steal SSH keys, AWS/GCP/Azure cloud credentials, Kubernetes configurations, git credentials, environment variables (including all API keys), shell history, encrypted wallets, SSL private keys, CI/CD secrets, and database passwords. Malicious code encrypts data with 4096-bit RSA and transmits it to a disguised domain, models.litellm.cloud, and also attempts to create privileged containers in the kube-system namespace of Kubernetes clusters to implant persistent backdoors.

Even more dangerous is its contagious nature: any project depending on LiteLLM can also be compromised. For example, pip install dspy (which depends on litellm>=1.64.0) will also trigger malicious code. The infected versions only survived about an hour on PyPI before being discovered, ironically because the attacker’s malicious code had a bug that caused memory exhaustion and crashes. Developer Callum McMahon encountered this when using the MCP plugin in the AI programming tool Cursor; LiteLLM was pulled in as a transitive dependency, and after installation, the machine crashed immediately, exposing the attack. Karpathy commented, “If the attacker didn’t vibe code this time, it might go unnoticed for days or even weeks.”

The threat group TeamPCP exploited a configuration flaw in LiteLLM’s CI/CD pipeline using Trivy vulnerability scanner in GitHub Actions at the end of February, stealing PyPI publishing tokens, then bypassing GitHub to upload malicious versions directly to PyPI. Berri AI CEO Krrish Dholakia, the maintainer of LiteLLM, stated that all publishing tokens have been revoked and plans to shift to a JWT-based trusted release mechanism. PyPA issued security advisory PYSEC-2026-2, recommending all users who installed affected versions assume their environment credentials have been compromised and should rotate them immediately.