Poisoned LiteLLM 1.107.0 shipped a credential stealer to PyPI and Docker for under three hours
LiteLLM said on October 21 that attackers published a malicious litellm 1.107.0 to PyPI, Docker Hub and GHCR, built from a lookalike Berri-AI/litellm repository. The package stole credentials and installed a backdoor; Wiz saw stolen AWS role credentials tested hours later.
LiteLLM disclosed on October 21 that attackers had compromised its release workflow and published litellm==1.107.0, an AI gateway package, containing a credential stealer and a backdoor. The seven PyPI wheels were live from 11:39 to 13:23 UTC, and the v1.107.0, latest, main-latest and main-stable tags on Docker Hub pointed to a compromised image from 11:46 to 14:20 UTC; GHCR tags were affected until 13:51 UTC. The artifacts were built from a lookalike repository, Berri-AI/litellm, so the official source tag is clean. The Hacker News, citing Wiz, reported that a cook.pth file collected cloud, browser, developer and AI tool secrets, and that about 4.5 hours later the attacker tested AWS instance role credentials from compromised CI runners and Kubernetes nodes, then queried Bedrock. Enterprise customers on LiteLLM's private registry were not affected.
Why it matters
An AI gateway holds every provider key an organization uses, plus its cloud role, so a poisoned gateway release is a bulk theft of non-human identities. The first thing the attacker did with the loot was call sts:GetCallerIdentity, which is a cheap signal you can alert on.
If 1.107.0 ran anywhere with outbound internet, LiteLLM says to assume exfiltration. Do not run pip first: remove cook.pth, cook.py and sitecustomize.py from site-packages, kill the daemon holding /tmp/remote_code_loader.lock, rebuild images, and pin to 1.106.2. Then rotate the instance role, every provider key in the proxy database, master and virtual keys and the database password, following a secrets rotation runbook. Pin images by digest, not tag. LiteLLM gateways were also in our September post on the example admin key.
Source: LiteLLM
Related on Start with Identity
- BlogLiteLLM traces its poisoned release to an admin key leaked in May and never revoked
LiteLLM's October 23 attack-chain report says an Agent Platform admin key committed to a public repo on May 27 was deleted but never revoked. On October 10 it r
- BlogInfisical raises a $40 million Series B to build secrets and credential access for AI agents
Infisical announced a $40 million Series B on October 27 at a $600 million valuation, led by Elad Gil. The open-source secrets company says it will invest in se
- BlogGoogle: LLMjacking starts with stolen cloud identities and has cost some companies $1 million
Google Threat Intelligence Group and Mandiant say LLMjacking intrusions ran up more than $100,000 in fraudulent AI charges in a day and $1 million in total at s
- CVEtj-actions/changed-files tags repointed to dump CI secrets into logs
An attacker repointed tj-actions/changed-files version tags to a commit that read the GitHub Actions runner's memory and printed its secrets into workflow logs.
- CVETrivy release and GitHub Action tags hijacked to steal CI secrets
With credentials left valid by a non-atomic rotation, an attacker shipped a malicious Trivy v0.69.4 and repointed 76 of 77 trivy-action tags to code that dumped
- CVEOver-scoped CodeBuild GitHub token let an attacker ship code in Amazon Q Developer 1.84.0
An inappropriately scoped GitHub token in the CodeBuild configuration for the Amazon Q Developer VS Code extension let an attacker commit code that shipped auto