LiteLLM, a widely used Python package for calling AI models, was compromised on October 21 in a software supply chain attack. Version 1.107.0, published to PyPI as wheels and in Docker images, delivered a credential stealer and a backdoor, according to reports from SafeDep, Socket, StepSecurity and Upwind cited by The Hacker News. PyPI has quarantined the package and the malicious Docker images have been removed.
LiteLLM’s director of security, Oliver Jensen, said the malicious actions were taken through three engineers’ GitHub accounts, apparently with stolen GitHub CLI OAuth tokens: one account triggered the release run and another approved it. The tokens involved have been revoked, but the company says it has not yet found how the attacker got them. StepSecurity found that the release was built from a lookalike GitHub repository, with the payload added on top of a clean v1.107.0 tag. The malware runs whenever Python starts on the machine, even if LiteLLM is never imported, because it installs a .pth file. It collects cloud tokens, SSH and GPG keys, browser data, the configuration files of AI coding tools and LiteLLM proxy credentials, sends them to a lookalike domain, and starts a background process that checks a GitHub page every hour for more Python code to run. This is the second LiteLLM compromise this year, after the March incident that The Hacker News ties to the TeamPCP attacks.
How to check if you’re affected
Affected versions are LiteLLM 1.107.0 installed from any of its seven PyPI wheels. The source archive (.tar.gz) carries a tampered pyproject.toml but no payload files, per The Hacker News. Affected products also include LiteLLM Docker images pulled on October 21: StepSecurity lists the v1.107.0 tag and any pull of latest, main-latest or main-stable for ghcr.io/berriai/litellm, litellm-database, litellm-non_root and docker.io/litellm/litellm, from about 11:48 UTC until BerriAI removed the images that afternoon.
- Run
pip show litellm(or check your lockfile and container image digests) for version 1.107.0. - StepSecurity’s recovery steps name these indicators:
cook.pth,cook.pyandsitecustomize.pyinsite-packages, a detached Python process holding/tmp/remote_code_loader.lock, and traffic tolitellm.dev. - StepSecurity advises treating any host that ran the malicious version as fully compromised, pinning
litellm==1.106.2, and rotating every credential the host could reach: cloud keys and instance roles, SSH and GPG keys, browser passwords, AI tool tokens, CI and Vault secrets, and the provider API keys stored in the LiteLLM proxy database.
Sources
- BerriAI/litellm issue #47826: litellm 1.107.0 compromised
- StepSecurity: LiteLLM 1.107.0 compromised, PyPI backdoored wheels and credential stealer
- SafeDep: LiteLLM PyPI compromise, credential stealer and backdoor
- Upwind: LiteLLM 1.107.0 supply chain attack
- The Hacker News: LiteLLM Compromised in Supply Chain Attack Delivering Credential Stealer and Backdoor