Attackers Slip a Credential Stealer Into LiteLLM, an AI Tool Downloaded 23 Million Times a Week

Attackers hijacked the release pipeline of LiteLLM, a popular open source tool that routes requests between apps and AI model providers, and published a malicious version to the Python Package Index on Wednesday, October 21. The poisoned release, version 1.107.0, also went out through LiteLLM's official Docker images. The package is downloaded about 23 million times a week, according to Datadog Security Labs, which makes it one of the most widely used pieces of plumbing in AI development.

What the malware did

The malicious release carried three files that do not exist in the genuine project: cook.pth, cook.py and sitecustomize.py. Once installed, they landed in a Python folder that the interpreter reads every time it starts, so the code ran on any Python launch, even in programs that never used LiteLLM itself. One file ran a credential stealer that security firms say went after SSH and GPG keys, cloud credentials for AWS, Microsoft Azure and Google Cloud, Kubernetes and Docker secrets, browser passwords and cookies, and the stored AI provider keys inside LiteLLM proxy databases. A second component woke up every hour to fetch and run fresh code from a server the attackers controlled, giving them a standing backdoor into infected machines.

How the attackers got in

LiteLLM says the intruders worked through the GitHub accounts of three of its engineers, apparently using stolen GitHub CLI OAuth tokens. One account was used to trigger the project's private release workflow and another to approve it, and the run built the release from a malicious copy of the project named Berri-AI/litellm, one hyphen away from the real BerriAI/litellm. The company has revoked every token involved and cut its GitHub organization down to a single unaffected user while it investigates. Oliver Jensen, LiteLLM's director of security, said the team still does not know how the tokens were stolen in the first place.

Two hours on the shelf

The bad release went live on PyPI at 11:39 UTC and was removed at 13:23 UTC, a window of about two hours, according to JFrog Security Research. The Docker tags v1.107.0, latest, main-latest and main-stable pointed at the poisoned images until about 14:20 UTC. Research teams at Upwind, SafeDep, Socket and StepSecurity published analyses the same day. It is the second time LiteLLM has been compromised this year: in March, versions 1.82.7 and 1.82.8 were poisoned in an attack later linked to the TeamPCP group, though researchers say no link has been established between the two incidents.

What users should do

Anyone who installed version 1.107.0 should treat every credential on that machine as exposed. Security firms advise rebuilding from the clean 1.106.2 release, deleting the three planted files by hand because uninstalling the package leaves them behind, and rotating cloud keys, SSH keys and AI service tokens. Simply removing the package is not enough, since the planted files sit outside it and the hourly loader keeps running until it is killed.