LiteLLM release pipeline hacked to distribute credential-stealing malware
Malicious version 1.107.0 stayed on PyPI for about two hours on October 21 before removal.
Attackers used stolen GitHub credentials from three developer accounts to redirect LiteLLM’s release workflow to a lookalike repository. Version 1.107.0 on PyPI and Docker images tagged latest, main-latest, and main-stable were affected. Aikido said startup files stole cloud credentials and API keys from LiteLLM’s database and ran a remote access trojan that fetched code hourly. LiteLLM said the incident is contained and private enterprise-registry customers were unaffected.
Unconfirmed: LiteLLM has not established initial access, including whether Claude Code exposed the GitHub tokens.
- PyPI packages were available for about two hours; Docker images were withdrawn later on October 21.
- The malware also targeted Kubernetes service-account tokens and GitLab and Jenkins secrets.
- A March package compromise was linked by the project to Trivy in the release pipeline.
- LiteLLM advises rotating exposed credentials rather than only removing the package.
Impact: theft of cloud credentials and API keys, plus remote code execution
| Product | Affected |
|---|---|
| LiteLLM | 1.107.0 |
- 1.Treat compromised open-source deployments as breached and rotate every reachable secret.
- 2.Identify affected packages and image digests, isolate hosts, and rebuild from trusted software.
- 3.Do not launch Python or pip on suspected hosts because startup hooks may run again.
- Vendors
- LiteLLM
- Products
- Claude Code
- Organizations
- Aikido
From the original article
4 min read at csoonline.com
Hackers hijacked the software release pipeline of LiteLLM, a popular open-source AI gateway, to distribute credential-stealing malware, marking the project’s second supply chain compromise this year despite security measures introduced after an earlier attack. The compromised version, 1. 107.
csoonline.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.