Malicious LiteLLM release steals credentials from AI developers

LiteLLM, the open-source library and proxy that many developers use to route requests to different AI providers’ models, disclosed that its release pipeline had been compromised on 21 October. Version 1.107.0 was pushed to PyPI and Docker containing what the project described as compiled malware that steals credentials and loads remote-code-execution tools. LiteLLM said all earlier versions were safe and that customers of its private enterprise release were not affected.

By LiteLLM’s timeline, the seven malicious PyPI files went up at about 11:39 UTC and were removed by 13:23. Docker Hub tags pointed to a compromised image until about 14:20. Wiz, the cloud-security firm, put the number of downloads at roughly 49,000, citing PyPI download statistics from ClickPy. It did not give a count for container pulls.

Wiz’s analysis said the payload collected cloud credentials for AWS, Google Cloud and Azure, API keys for providers including OpenAI and Anthropic, SSH and GPG keys, browser data and shell history, and encrypted the haul before sending it to a lookalike domain. On servers running the LiteLLM proxy, it also queried the proxy’s database for every stored provider credential. Wiz said it saw the attacker testing harvested AWS credentials several hours after exfiltration, including calls consistent with hijacking access to hosted AI models. It named no actor, noting only infrastructure clues and signs of AI-assisted code.

How the attacker got in was unsettled. LiteLLM said the malicious builds came from an attacker-controlled lookalike repository, Berri-AI/litellm, not the project’s real source tag, and that three developers’ GitHub credentials were used, which let the attacker override branch protections and approval gates. Its post said it suspected stolen GitHub CLI OAuth tokens, and that Claude Code can embed such a token in a response body that may then be logged. It also said it suspected a recently patched vulnerability on an exposed internal deployment, but had not confirmed the entry point. The post itself warned that some early assumptions had proved inaccurate or incomplete. It added that the pipeline had been hardened after an earlier incident in March.

The advice was to pin to version 1.106.2, assume exfiltration on any host that ran 1.107.0, and rotate every credential it could reach. The case showed a library that sits between applications and many AI providers holding keys for all of them, so a compromise of its release process reaches more than one account.