Hacker News flags compromised LiteLLM PyPI releases that execute on Python startup

Hacker News surfaced an urgent supply-chain incident affecting LiteLLM after users linked to the BerriAI GitHub investigation into versions 1.82.7 and 1.82.8 on PyPI. The important detail is that this was not a normal bug or a malicious prompt hidden behind an import path. According to the maintainers' March 24, 2026 updates, one compromised release path executed code as soon as the Python interpreter started.

The primary analysis in issue #24512 says version 1.82.8 shipped with a litellm_init.pth file inside the wheel. Because Python processes .pth files automatically at startup, the payload could run even if an operator never imported LiteLLM. The same write-up describes the package as collecting environment variables, SSH material, and cloud credentials before sending them to an attacker-controlled domain. The maintainers' follow-up status thread says 1.82.7 was also malicious, though its trigger path was narrower: importing litellm.proxy.

• Maintainers say the compromised packages were removed from PyPI.
• The status update says the release chain compromise is under investigation and maintainer accounts were rotated.
• BerriAI also said its proxy Docker image users were not impacted because dependencies were pinned in requirements.txt.

What made the HN discussion notable was how quickly it reframed LiteLLM from a routine dependency update into an incident-response problem. The official recommendations are not subtle: inspect systems for the malicious .pth file, rotate every credential that may have been exposed on machines where the packages were installed, and audit for unauthorized access. The updates also note that Google's Mandiant team was engaged while the broader blast radius was investigated.

For engineers shipping agent stacks or proxy layers, the bigger lesson is about packaging trust. LiteLLM sits close to model credentials, vendor API keys, and infrastructure configs, so compromise at install time turns a standard Python package update into a privileged foothold. HN's reaction was less about panic than about recognizing how much sensitive material modern LLM tooling can see by default.

Primary sources: technical analysis and maintainer status timeline. Community source: Hacker News thread.