Malicious LiteLLM 1.107.0 packages hit PyPI and Docker Hub
Original title: LiteLLM Compromised in Fresh Supply Chain Attack
The poisoned build was online about three hours, downloaded over 49,000 times, and the latest clean release is 1.106.2.
Attackers published malicious LiteLLM 1.107.0 packages to PyPI and Docker Hub on October 21. The packages stayed online about three hours and were downloaded more than 49,000 times before removal or retagging. LiteLLM says GitHub CLI tokens from an exposed internal account were used to reroute the release workflow. Users of that version got an information stealer and remote access trojan; private-repository enterprise pulls were not affected.
Unconfirmed: LiteLLM says it remains unclear how attackers reached the internal deployment or moved laterally; the Claude Code token leak is described as likely.
- Attackers disabled branch protections and published from a lookalike repository.
- The stealer harvested browser, cloud, SSH, GPG and AI API credentials.
- Stolen data was encrypted and sent to litellm[.]dev.
- Wiz says stolen AWS credentials queried Amazon Bedrock about 4.5 hours later.
- A RAT checked a GitHub dead drop hourly for attacker-supplied Python.
Impact: Info-stealer and RAT on systems that installed 1.107.0
| Product | Affected | Fixed in |
|---|---|---|
| BerriAI LiteLLM | 1.107.0 | 1.106.2 |
- 1.Remove LiteLLM 1.107.0 and use 1.106.2 or another clean build.
- 2.Rotate credentials and secrets the malicious package could have accessed.
- 3.Sweep affected systems for the stealer and remote access trojan.
- ATT&CK
- T1195.002 Compromise Software Supply ChainT1555.003 Credentials from Web BrowsersT1102.001 Dead Drop Resolver
- Vendors
- BerriAI
- Products
- LiteLLMClaude Code
- Organizations
- WizStepSecurity
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | litellm.dev | les, and GPG keys. The stolen data is encrypted and sent to litellm[.]dev . Cybersecurity outfit Wiz says the attackers started abu |
From the original article
2 min read at securityweek.com
Hackers used compromised GitHub CLI OAuth tokens to push and approve malicious packages on PyPI and Docker. The post LiteLLM Compromised in Fresh Supply Chain Attack appeared first on SecurityWeek.
By Ionut Arghire · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.