Malicious LiteLLM v1.107.0 on PyPI and Docker stole credentials
Original title: LiteLLM hit by second supply chain attack this year, users urged to rotate credentials
The build stayed up for under two hours on PyPI; anyone who installed it is told to rotate credentials, not only upgrade.
On October 21, a compromised LiteLLM release pipeline pushed v1.107.0 to PyPI and Docker with compiled malware that steals credentials and loads remote-code execution tools. LiteLLM says the attacker used stolen GitHub CLI OAuth tokens from three engineers’ accounts, likely taken from logs of an internet-exposed internal deployment, and has pulled the releases. The safe version is v1.106.2. Wiz says stolen AWS credentials were tested within hours, including checks against Amazon Bedrock.
Unconfirmed: LiteLLM suspects a recently patched vulnerability for the initial access but says that path is not confirmed.
- PyPI hosted the package from 11:39 to 13:23 UTC; bad Docker tags ran until 14:20 UTC.
- Malicious code sits in Python startup files and runs even if LiteLLM is never imported.
- The stealer targets cloud, Git, SSH, browser, and AI-tool credentials, then posts to litellm[.]dev.
- Socket cites about 23 million weekly downloads; private-registry enterprise customers were not affected.
- LiteLLM has not confirmed how the internal deployment was first accessed.
Impact: Steals cloud logins, developer secrets, and AI API keys
| Product | Affected | Fixed in |
|---|---|---|
| BerriAI LiteLLM | v1.107.0 | v1.106.2 |
- 1.Treat credentials as compromised and rotate them if v1.107.0 was installed.
- 2.Use v1.106.2; impacted PyPI and Docker releases were pulled.
- 3.Review indicators published by Aikido, Wiz, and Socket.
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | litellm.dev | ata is encrypted and sent to a “healthcheck” address on the litellm[.]dev domain. A second component keeps checking a file on GitHu |
From the original article
3 min read at helpnetsecurity.com
A malicious release of LiteLLM pushed to PyPI and Docker registries on Wednesday carried malware built to harvest cloud logins, developer secrets and API keys for AI services from anyone who installed it. “LiteLLM got compromised… again,” security researcher Kevin Beaumont wrote on Mastodon.
By Sinisa Markovic · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.