The litellm wheel packages for versions 1.82.7 and 1.82.8 on PyPI contain a malicious .pth file (litellm_init.pth, 34,628 bytes). This file automatically executes a credential-stealing script on every Python interpreter startup, with no import litellm required. Users are advised to downgrade to 1.82.6, which is not compromised.