LiteLLM hit by second supply chain attack this year, users urged to rotate credentials
A malicious release of LiteLLM pushed to PyPI and Docker registries on Wednesday carried malware built to harvest cloud logins, developer secrets and API keys for AI services from anyone who installed it.
“LiteLLM got compromised… again,” security researcher Kevin Beaumont wrote on Mastodon.
In August, Hudson Rock analyzed a 153GB archive stolen during an earlier LiteLLM supply chain attack, in March, and linked it to 2,488 corporate domains, including AWS, Samsung, Cisco and Salesforce, while CloudSEK put the number of exposed organizations at close to 2,500.
“At 4:00 AM PST October 21, LiteLLM’s release pipeline was compromised and pushed v1.107.0 to the docker registry and PyPi. This version contained compiled malware which steals credentials and loads remote-code execution tools,” reads LiteLLM’s blog post.
“All previous versions are safe, and the impacted releases have been pulled.”
The malicious package stayed on PyPI from 11:39 to 13:23 UTC, while Docker images tagged v1.107.0, latest, main-latest and main-stable served the bad build from 11:46 to 14:20 UTC.
“The most recent safe version is v1.106.2,” Wiz researchers Benjamin Read and Rami McCarthy stated. Updating alone is not enough, though, and Aikido researcher Ilyas Makari advised that anyone who installed 1.107.0 before it was pulled should still treat their credentials as compromised and rotate them.
Tokens taken from an exposed deployment
According to LiteLLM, the attacker worked through the GitHub accounts of three of its engineers, apparently using stolen GitHub CLI OAuth tokens. One account was used to change the release pipeline and trigger the release, a second to approve it and a third to delete the workflow records, which limited the logs available to investigators.
The company found an unexpected, innocuously named user account in its internal LiteLLM deployment, which was exposed to the public internet. “We believe the attacker gained access to this deployment,” the company wrote, adding that the tokens were then lifted from the deployment’s logs and used to compromise the release workflow.
LiteLLM has observed specific situations in which Claude Code embeds a user’s GitHub CLI OAuth token into a response body, so where response bodies are logged, those tokens may appear in LiteLLM logs.
“We have not yet confirmed how the attacker gained access to our internal deployment, but currently suspect it was through a recently patched vulnerability,” LiteLLM stated.
The company describes the incident as contained, with the investigation still underway, and is working to identify and revoke or rotate every authentication token across its organization. Enterprise customers using LiteLLM’s private registry were not affected.
Malicious LiteLLM code runs whenever Python starts
Supply chain security firm Socket puts LiteLLM’s weekly downloads at about 23 million and warns that a compromised installation can run alongside provider API keys, cloud identities and database connection strings.
The firm’s analysis shows the poisoned release reached PyPI in seven builds for macOS, Linux and Windows. The malicious code was placed in Python startup files, which means it runs whenever Python starts in an affected environment, even if the application never loads LiteLLM.
Build records for the project’s container image show the release workflow recorded a repository called Berri-AI/litellm as its source, one hyphen away from the legitimate BerriAI/litellm project.
Along with credentials for AWS, Azure, Google Cloud, Kubernetes and Docker, the stealer goes after Git credentials, SSH and GPG keys, saved browser logins and cookies, browsing history and shell history.
It also looks for authentication files belonging to Codex, Claude, Gemini and Cursor, and tries to pull stored credentials and model settings from the database of LiteLLM proxy deployments, though the researchers caution this shows intent and does not prove the attackers succeeded against any particular deployment.
The collected data is encrypted and sent to a “healthcheck” address on the litellm[.]dev domain. A second component keeps checking a file on GitHub for a domain from which to download and run more Python code. When Socket’s researchers checked the file on October 21, it was empty, though the stealer works independently of it and the file could be changed later.
Stolen keys tested within hours
Wiz researchers have seen the stolen credentials in use. About four and a half hours after the data left victims’ systems, the attacker began validating AWS credentials taken from compromised CI runners and Kubernetes nodes and checking whether they could reach AI models on Amazon Bedrock, activity they link to LLMjacking.
In a small number of environments, the attacker went on to list IAM roles, users and access keys and to look up account and logging details.
Aikido, Wiz and Socket have each published detailed analyses with indicators of compromise and cleanup steps for LiteLLM users and security teams.
