SFTY-20260324-28516

Affected versions of litellm package contain Embedded Malicious Code. Upon installation, a malicious `.pth` file executes automatically at Python startup, launching a background process that exfiltrates credentials from SSH keys, cloud providers (AWS, GCP, Azure, Kubernetes), cryptocurrency wallets, and CI/CD secrets to an attacker-controlled server. The malware establishes persistent backdoor access via a systemd service and attempts to take over the entire Kubernetes cluster if running in a containerized environment.