Malicious LiteLLM 1.107.0 published after suspected token leak
Original title: LiteLLM Suspects GitHub Token Leak in AI Gateway Logs Behind Malicious Package Release
Unpinned installs for a few hours on October 21 pulled a credential stealer and an hourly remote-code backdoor.
LiteLLM said its release pipeline was compromised around 4:00 a.m. PST on October 21, publishing malicious 1.107.0 to PyPI, Docker Hub, and GHCR. The package harvests system, browser, developer, cloud, and AI-tool secrets and fetches remote Python code every hour. Maintainers suspect GitHub CLI OAuth tokens were written into logs of a publicly exposed internal deployment, then used to disable branch protections and sign the release. Wiz later saw stolen AWS role credentials used in activity consistent with LLMjacking.
Unconfirmed: How the internal deployment became public is unclear; a recently patched vulnerability is only LiteLLM's theory, and a link to TeamPCP is unverified.
- Affected windows were roughly 11:39 a.m. to 1:23 p.m. UTC for pip and until 2:20 p.m. UTC for Docker.
- A cook.pth import runs privcollect and posts data to litellm.dev/healthcheck.
- On Linux and macOS, sitecustomize.py pulls a second stage from a GitHub dead drop.
- Wiz saw sts:GetCallerIdentity and Bedrock model listing from 168.100.8.57 and 165.227.201.8.
- Socket said public evidence does not link this to the March TeamPCP incident.
Impact: Credential theft and hourly remote code execution on hosts that installed the package
| Product | Affected |
|---|---|
| BerriAI LiteLLM | 1.107.0 on PyPI; v1.107.0, latest, main-latest, and main-stable on Docker and GHCR |
- 1.Remove LiteLLM 1.107.0 and isolate hosts that installed the malicious build
- 2.Hunt for cook.pth, cook.py, and sitecustomize.py on affected machines
- 3.Review cloud credentials from those hosts after reported AWS role abuse
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | litellm.dev | er, cloud, and AI tool secrets, and exfiltrate the data to "litellm[.]dev/healthcheck" via an HTTP POST request. In addition, the i |
| domain | raw.githubusercontent.com | the attacker's current C2 domain from a GitHub repository (raw[.]githubusercontent[.]com/letters9813/pythonclient-test/main/domain[.]txt), then |
| ipv4 | 165.227.201.8 | resses between 4:20 p.m. and 5:01 p.m. UTC - 168.100.8[.]57 165.227.201[.]8 "Each credential was checked with sts:GetCallerIdentity, |
| ipv4 | 168.100.8.57 | ollowing IP addresses between 4:20 p.m. and 5:01 p.m. UTC - 168.100.8[.]57 165.227.201[.]8 "Each credential was checked with sts:Get |
From the original article
4 min read at thehackernews.com
LiteLLM on Wednesday disclosed that threat actors compromised "multiple independent security controls" to push a malicious version of the Python package containing a credential stealer and a backdoor. On October 21, 2026, LiteLLM's release pipeline was compromised to push 1. 107.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.