LiteLLM Compromised in Fresh Supply Chain Attack

What it is

LiteLLM 1.107.0, the open source proxy for routing requests across LLM providers, was published with malware to PyPI and Docker Hub on October 21. The packages were live for about three hours and were downloaded an estimated 49,000 times. PyPI removed them, and Docker Hub tags and image variants were removed or repointed to clean artifacts. LiteLLM says enterprise customers pulling from its private repository were not affected.

How it works

The attackers got GitHub CLI OAuth tokens for an innocuously named user account in an internal LiteLLM deployment that was exposed to the public internet. LiteLLM believes Claude Code, in specific circumstances, embedded the tokens in a response body that was then written to LiteLLM logs. The attackers likely read them from those logs. They held three sets of developer GitHub CLI credentials.

With those credentials they:

• disabled branch protections;
• merged a change that pointed the releaser to a different source repository;
• ran a compromised GitHub workflow that pulled from a lookalike repository, Berri-AI/litellm (the real one is BerriAI/litellm);
• signed and published the poisoned artifacts.

The payload extracts three files into the site-packages root, so they run whenever a Python interpreter starts. The stealer collects:

• system information, browser credentials and cookies;
• developer credentials and environment variables;
• AWS, GCP and Azure secrets;
• API keys for Anthropic, GitHub Copilot, OpenAI and other AI tools;
• SSH private keys, shell history and GPG keys.

It encrypts the data and sends it to litellm[.]dev. The RAT contacts the attackers' C&C server regularly. StepSecurity reports it also checks a GitHub dead drop every hour and runs whatever Python the attacker serves there. The page says the payload was likely built with AI help.

Preconditions / Affected

Anyone who installed or pulled 1.107.0 from PyPI or Docker Hub during the roughly three-hour window. Because the files sit in site-packages, any Python process in that environment triggers them, not only LiteLLM itself.

What to do

• Remove 1.107.0 immediately. The last clean version is 1.106.2.
• Rotate every credential the host could reach: cloud keys, AI provider keys, GitHub tokens, SSH keys, GPG keys and anything in environment variables.
• Sweep the system for malware, since the RAT can run attacker-supplied code.
• Check for traffic to litellm[.]dev and for the hourly GitHub dead-drop polling.
• Check AWS accounts for unexpected Bedrock model queries.

Caveats

• LiteLLM has not explained how the attackers reached the internal deployment or moved laterally.
• The Claude Code token leak is described as likely, not confirmed.
• Wiz says abuse of stolen credentials began about 4.5 hours after exfiltration. It observed Amazon Bedrock queries with stolen AWS keys, which it reads as LLMjacking. Rotation therefore has to be fast.
• The page gives no file names or hashes for the three dropped files.