Silicon Valley’s two biggest dramas have intersected: LiteLLM and Delve

A credential-stealing malware was found in the LiteLLM open-source project after being introduced via a dependency; the malicious code harvested login credentials and attempted to move laterally through other packages and accounts. The infection caused a researcher’s machine to crash, was discovered and disclosed quickly, and LiteLLM is conducting a forensic investigation while addressing concerns about third-party security certifications.