Two malicious LiteLLM PyPI releases, versions 1.82.7 and 1.82.8, ran on March 24 for about 40 minutes and stole cloud keys, SSH keys, Kubernetes tokens, and database passwords; CloudSEK says the captured material could map to more than 2,500 organizations, and the flaw is tracked as CVE-2026-33634.
The malicious code ran during install, when developer machines or CI/CD runners already had secrets in memory or on disk, so the package itself became the trap that pulled out whatever credentials were present. CloudSEK has also published a public lookup built from the loot, with rows that tie captured files to named organizations and domains, so exposure can be identified before any formal notice arrives.
For teams that used LiteLLM in build systems or on workstations, the blast radius sits with every secret those systems could reach during the suspect window, not just with the package version itself. If those credentials still work elsewhere, uninstalling the package does not close the downstream access path.