A critical supply chain attack has compromised two versions of LiteLLM, an open-source Python interface for large language models, by injecting malicious code into the software via a polluted CI/CD pipeline. The tainted packages were subsequently removed from the Python Package Index. This security breach has significant implications for users who may have already installed the affected versions, as the malware is designed to steal sensitive credentials. The attack highlights the vulnerability of open-source software to supply chain threats, particularly when malicious actors target the build process1. The removal of the compromised packages from PyPI mitigates further damage, but users who have already installed the affected versions are advised to take immediate action to protect themselves. This incident underscores the importance of vigilant monitoring and secure development practices in the open-source community, so what matters most to practitioners is the need to prioritize robust security measures to prevent similar attacks in the future.