The LiteLLM credential stealer harvests AWS credentials, GCP service account keys, Azure tokens, environment variables, browser data, and SSH private keys.

From the articleLiteLLM supply chain attack hoovers up passwords and secretsAlso in LiteLLM Compromised in Supply Chain Attack Delivering Credential Stealer and Backdoor, LiteLLM supply-chain attack targets credentials and installs a RAT | Межа