Something’s off.A report says a compromised LiteLLM release distributed information-stealing malware through its Python package and container images. In affected environments, researchers said that opening Python or using pip to investigate the installation could itself trigger the payload.
According to the researchers, the payload was placed in files involved in Python startup. The reported mechanism meant it could run each time Python started in a compromised environment.
The report says the malware sought credentials, secrets, environment variables, browser data and other information on the host.
UNVERIFIED
Feed metadata identifies a report, not independently verified underlying facts.
This is a source-attributed report that has not been independently verified.
