PyPI warns developers after LiteLLM malware found stealing cloud and CI/CD credentials

Malicious versions of LiteLLM, a popular Python library for working with large language models, were published on PyPI and stole credentials from developer environments before being removed after about two hours. The malware used a three-stage attack to harvest sensitive data like API keys, cloud credentials, and SSH keys (private authentication files), then encrypted and sent them to attacker-controlled servers. This incident is part of a larger supply chain attack (a coordinated effort to compromise widely-used software) called TeamPCP that also affected other developer security tools.