Prasenjit Sarkar (@stretchcloud) on X

What it is

A post by Prasenjit Sarkar (@stretchcloud) on the LiteLLM supply-chain compromise. The malicious release is LiteLLM 1.107.0, published on October 21 (the post gives no year). It was published from a lookalike repository, Berri-AI, one character off the real BerriAI. Sarkar also argues that LLM gateway libraries deserve the same pinning discipline as a database driver. This is the second LiteLLM compromise this year, after a March campaign that used a backdoored Trivy GitHub Action to harvest CI credentials.

How it works

Attackers spent eleven days inside LiteLLM's GitHub org. They pushed a workflow to a throwaway branch, let it run with real secrets, then deleted the branch. They took twenty secrets, including a GitHub App private key. On October 21 they used GitHub CLI OAuth tokens stolen from three engineers to publish 1.107.0.

The payload is a Python startup file that runs on every interpreter launch, with no import of LiteLLM needed. It scans sixteen credential categories, including AWS, GCP, Azure, Kubernetes, SSH keys, browser cookies, and API keys for OpenAI, Anthropic and Cohere. If DATABASE_URL is set, it reads the LiteLLM proxy's Postgres tables and extracts the upstream provider keys. A compromised proxy therefore exposes every provider key it was ever configured to route through.

Preconditions / Affected

• Any environment that installed 1.107.0 from PyPI and started a Python interpreter, since the startup file does not depend on importing the package.
• LiteLLM proxy deployments with DATABASE_URL set, where stored provider keys are exposed as well.
• Downstream agent stacks. Sarkar names CrewAI, Browser-Use, Mem0 and DSPy as tools built on this kind of gateway layer. LiteLLM gets roughly 23 million downloads a week.

What to do

The post gives no commands or remediation list. Its timings imply the following:

• Wiz saw the attacker validating stolen AWS credentials against live infrastructure within four and a half hours of exfiltration, so rotation of exposed credentials cannot wait.
• Socket flagged the wheels seven minutes after they reached PyPI, so a package scanner or install delay could have caught this.
• Sarkar says most teams pin LiteLLM like a logging package. His recommendation is to treat it like a database driver.

Caveats

The post is a secondary commentary and does not link a primary advisory. It ends with a truncated link fragment to a post by feross. It does not say which versions are safe, whether 1.107.0 was yanked, or how to detect the startup file on a host. Check the official LiteLLM and PyPI advisories before acting.