LiteLLM 1.107.0 release carried credential-stealing malware
Original title: LiteLLM Supply Chain Compromise Exposes AI Developer Credentials to Malware Attacks
Malicious Python startup hooks can collect cloud and AI credentials even when applications never import LiteLLM.
Socket reported on October 21, 2026 that LiteLLM 1.107.0 PyPI wheels and container images installed a credential collector. Startup files can run when Python or pip starts, targeting cloud, SSH, browser, and AI assistant secrets, then uploading encrypted JSON. Container tags v1.107.0, latest, main-latest, and main-stable resolved to the same image. Socket found no evidence of successful theft from individual deployments, and how a repository override was authorized remains unclear.
Unconfirmed: How the source-owner override was authorized is unknown, and no successful theft from a deployment was shown.
- LiteLLM receives about 23 million weekly downloads, Socket said.
- Seven malicious wheels were flagged about seven minutes after publication.
- The collector covers AWS, Azure, Google Cloud, Kubernetes, SSH keys, and assistants including Codex, Claude, Gemini, and Cursor.
- A separate loader can fetch unsigned Python from a GitHub pointer and retries hourly.
- Build provenance named Berri-AI/litellm rather than BerriAI/litellm.
Impact: Steals cloud, SSH, browser, and AI assistant credentials
| Product | Affected |
|---|---|
| BerriAI LiteLLM | 1.107.0 |
- 1.Block litellm 1.107.0, inspect image digests, and isolate hosts where Python ran after install.
- 2.Rotate potentially exposed credentials from a clean system and rebuild from reviewed artifacts.
- 3.Do not rely on removing LiteLLM alone to stop an existing loader.
- ATT&CK
- T1195.002 Compromise Software Supply ChainT1059.006 PythonT1552 Unsecured CredentialsT1041 Exfiltration Over C2 Channel
- Vendors
- BerriAI
- Products
- LiteLLM
- Malware
- privcollect
- Organizations
- Socket
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | raw.githubusercontent.com | xp://www[.]litellm[.]dev/healthcheck Loader pointer hxxps://raw[.]githubusercontent[.]com/letters9813/pythonclient-test/main/domain.txt Upload he |
| domain | www.litellm.dev | Type Indicator Package litellm==1.107.0 Exfiltration hxxp://www[.]litellm[.]dev/healthcheck Loader pointer hxxps://raw[.]githubusercont |
| sha256 | 34bef04fe88ac9d0aae0475630b1738681d15b94f233ac8aa46eacf5968305fa | be93139cc4ebef3ef9e2efe9531390be25 sitecustomize.py SHA-256 34bef04fe88ac9d0aae0475630b1738681d15b94f233ac8aa46eacf5968305fa Note: IP addresses and domains are intentionally defanged ( |
| sha256 | 9dd0a3926f96a37eb86cf1ee2310d9be93139cc4ebef3ef9e2efe9531390be25 | n marker /tmp/.pc_once_72129118c59f5636c0bb cook.py SHA-256 9dd0a3926f96a37eb86cf1ee2310d9be93139cc4ebef3ef9e2efe9531390be25 sitecustomize.py SHA-256 34bef04fe88ac9d0aae0475630b1738681 |
| url | https://raw.githubusercontent.com/letters9813/pythonclient-test/main/domain.txt | ation hxxp://www[.]litellm[.]dev/healthcheck Loader pointer hxxps://raw[.]githubusercontent[.]com/letters9813/pythonclient-test/main/domain.txt Upload header X-Token: XWiA8gZNa7NcX2XRoAEb Loader lock |
| url | http://www.litellm.dev/healthcheck | n. IoC Type Indicator Package litellm==1.107.0 Exfiltration hxxp://www[.]litellm[.]dev/healthcheck Loader pointer hxxps://raw[.]githubusercontent[.]com/le |
From the original article
2 min read at gbhackers.com
LiteLLM version 1. 107. 0 was compromised in a supply chain attack that distributed credential-stealing malware through PyPI wheels and container images.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.