LiteLLM Hit by Supply Chain Attack: Credential Stealer Targets 23M Weekly Users

LiteLLM Release Pipeline Compromised Through Stolen GitHub Tokens

On October 21, 2026, threat actors executed a sophisticated supply chain attack against LiteLLM1

1

, the widely-used open-source AI gateway and Python SDK. The attackers compromised the project's release pipeline to distribute malicious version 1.107.0 containing a credential stealer and remote access trojan through PyPI and Docker registries2

2

. The compromised PyPI package was live from 11:39:51 to 13:23 UTC, while Docker Hub images remained accessible from 11:46:56 to 14:20 UTC2

2

. PyPI quarantined the malicious version within hours, and Docker images were removed from both Docker Hub and GHCR shortly after detection1

1

.

The attack leveraged stolen GitHub OAuth tokens from three developer accounts to bypass security controls. According to LiteLLM's investigation, the attacker used one account to disable branch protections and force-push malicious changes, while another approved the compromised workflow3

3

. The attackers pointed the workflow to a lookalike repository "Berri-AI/litellm" instead of the legitimate "BerriAI/litellm," causing poisoned artifacts to be signed and published3

3

. LiteLLM suspects that Claude Code embedded GitHub CLI OAuth tokens into response bodies, which appeared in logs of an internal deployment exposed to the public internet3

3

.

Infostealer Malware Targets AI and Cloud Credentials Across 16 Modules

The malicious version 1.107.0 contained three weaponized files—cook.pth, cook.py, and sitecustomize.py—strategically placed in Python's library directory to execute automatically at interpreter startup1

1

. The infostealer, called privcollect, harvested sensitive data across 16 modules targeting browsers, cloud providers, and AI services1

1

. Security researchers detected the attack within six minutes of publishing2

2

.

The credential stealer specifically targeted browser credentials and cookies from Chrome, Firefox, Edge, and Safari, along with AWS credentials from ~/.aws/, environment variables, and EC2/ECS instance metadata1

1

. It collected Google Cloud Platform service account keys and application default credentials, plus Microsoft Azure tokens from the CLI cache1

1

. The malware also extracted API keys for OpenAI, Anthropic, Cohere, and other LLM providers, along with SSH private keys, GPG keys, and shell history files1

1

. All stolen data was encrypted using AES-256-CBC, with the encryption key wrapped using RSA-4096, before being sent via HTTP POST to the attacker-controlled domain litellm[.]dev/healthcheck1

1

.

Remote Access Trojan Enables Persistent Backdoor Access

The sitecustomize.py file functioned as a remote access trojan, spawning a background daemon that polled attacker infrastructure every hour for new commands1

1

. The backdoor acquired a lock at /tmp/remote_code_loader.lock to prevent multiple instances, then entered an infinite loop fetching the attacker's current command-and-control domain from a GitHub repository at raw[.]githubusercontent[.]com/letters9813/pythonclient-test/main/domain[.]txt3

3

. Once retrieved, it downloaded and executed Python payloads from the specified domain3

3

.

Wiz researchers noted this dual-technique approach, using both .pth files and sitecustomize.py simultaneously, appears to be the first documented case in the wild3

3

. The GitHub dead drop repository was removed around 1:30 p.m. UTC, but only after being populated with initial test values3

3

. Users should check for /tmp/.pc_once_* files indicating data exfiltration has occurred, and /tmp/remote_code_loader.lock files showing the command-and-control daemon ran or is still running1

1

.

Attackers Validated Stolen Credentials Within 4.5 Hours

Wiz observed abuse of stolen credentials starting approximately 4.5 hours post-exfiltration, with attackers validating AWS instance role credentials captured from compromised CI runners and Kubernetes nodes between 4:20 p.m. and 5:01 p.m. UTC3

3

. The validation attempts originated from IP addresses 168.100.8[.]57 and 165.227.201[.]83

3

. Each credential was checked with sts:GetCallerIdentity, followed by bedrock:ListFoundationModels and ListModels calls, consistent with LLMjacking tactics3

3

. In select environments, attackers also enumerated IAM resources through ListRoles, ListUsers, and ListAccessKeys, plus performed general discovery via ListAccounts and DescribeTrails3

3

.

This rapid exploitation window demonstrates the attackers' operational sophistication and immediate intent to monetize stolen AI tooling credentials. The focus on AWS Bedrock and model enumeration suggests threat actors are specifically targeting AI infrastructure for potential unauthorized model access or resource hijacking.

Massive Exposure Risk for Enterprise AI Deployments

LiteLLM's widespread adoption amplifies the attack's potential impact significantly. The AI gateway receives approximately 23 million weekly downloads and serves high-profile organizations including NVIDIA, Netflix, AT&T, and Okta2

2

. The project has 61,800 GitHub stars and 92 million monthly downloads on PyPI2

2

. A compromised installation can run alongside LLM provider API keys, cloud identities, and database connection strings, exposing valuable credentials and sensitive data1

1

.

An earlier LiteLLM compromise in March potentially exposed more than 2,500 organizations and 434,000 CI/CD pipelines worldwide when the TeamPCP hacking group breached Aqua Security's Trivy vulnerability scanner used in LiteLLM's CI/CD pipeline1

1

. This repeat targeting suggests LiteLLM has become a high-value target for supply chain attackers seeking access to AI infrastructure and credentials.

Immediate Actions Required for Affected Organizations

Organizations that deployed the compromised PyPI package or Docker images must assume their secrets have been stolen1

1

. Teams using version 1.107.0 should immediately stop deploying it and investigate environments where Python ran after installation, including proxy containers and CI runners1

1

. Affected Docker tags include v1.107.0, latest, main-latest, and main-stable2

2

.

Infected systems should be isolated and rebuilt from clean backups, with all exposed secrets rotated immediately2

2

. Simply removing the LiteLLM package directory may leave startup files or an active loader behind2

2

. The most recent safe version is 1.106.2, which users should pin by digest4

4

. Aikido Security, Wiz, and Socket have published extensive threat-hunting and mitigation instructions for security teams1

1

. Organizations should monitor for unauthorized API calls to AI services and cloud providers, particularly focusing on credential validation attempts and resource enumeration activities matching the observed attack patterns.