⚠️ PSA: LiteLLM 1.82.7, 1.82.8 on PyPI has been hacked and contains code that extracts credentials etc from the machine where it runs then self-replicates

IoCs:
File: litellm_init.pth (34,628 bytes) in site-packages/
File: ~/.config/sysmon/sysmon.py
File: ~/.config/systemd/user/sysmon.service
Domain: models.litellm[.]cloud
K8s: node-setup-* pods in kube-system

always pin your dependency versions.