A malicious LiteLLM release, version 1.107.0, was published on 21 October to PyPI and Docker with a credential stealer and a backdoor. It affects anyone who installed LiteLLM without pinning a version or used tags like latest that day. If that's you, isolate the machine and rotate every credential: uninstalling isn't enough.
Key facts
- On 21 October LiteLLM 1.107.0 was published to PyPI, Docker Hub and GHCR. According to The Hacker News, it affects anyone who pip-installed an unpinned version between 11:39 and 13:23 UTC, or used the v1.107.0, latest, main-latest or main-stable images between 11:46 and 14:20 UTC.
- SecurityWeek estimates around 49,000 downloads of the malicious packages. The project gets 92 million monthly downloads on PyPI, according to BleepingComputer.
- LiteLLM pulled the release in about 3 hours. Enterprise customers using its private registry are not affected.
- The malware steals AWS, Azure and GCP credentials, SSH and GPG keys, .env files, npm, PyPI and CI/CD tokens, AI API keys and browser data. It sends them to litellm[.]dev/healthcheck, a domain registered on 13 October.
- Wiz saw stolen credentials being abused about 4.5 hours after exfiltration, including queries to Bedrock models on AWS.
Am I affected if I don't use LiteLLM directly?
Possibly. LiteLLM is an open-source gateway that routes requests to multiple large language model providers, and many AI tools and agents ship it as a dependency. If your team or your development partner builds anything with AI in Python, check.
The nasty part: the malware runs every time Python starts in that environment, even if the application never imports LiteLLM. It does this through the files cook.pth and sitecustomize.py. Microsoft warns that deleting only the application files can leave the malware in place. On Linux and macOS, a background process also downloads and runs remote code every hour.
Wiz saw the attackers validate AWS instance role credentials and query Bedrock model services. That fits so-called LLMjacking: using AI models at the victim's expense. In plain terms, the bill may land on you.
How did the attackers get in?
On 24 October LiteLLM explained the root cause, as reported by The Hacker News. On 27 May a master key for its Agent Platform was mistakenly pushed to a public GitHub repository. Nobody revoked it. On 10 October an attacker used it to extract an unrestricted GitHub CLI OAuth token tied to the organisation owner.
With that access they disabled branch protections and redirected deployment to a lookalike repository, 'Berri-AI/litellm'. LiteLLM had temporarily relaxed its release approval control because of the rush to ship.
The explanation changed along the way. On 22 October LiteLLM suspected the tokens leaked from the logs of an exposed internal deployment, as The Hacker News reported. Two days later it pointed to the leaked key.
What to do today
- Ask your tech team or provider to look for LiteLLM 1.107.0 on laptops, servers, CI runners and containers, including as an indirect dependency.
- Check which Docker images were pulled or rebuilt on 21 October with tags such as latest.
- If you find a match, isolate the machine. Look for cook.pth, sitecustomize.py and execution of /codepy.
- Block the litellm[.]dev domain on your network.
- Rotate every credential in that environment: cloud, GitHub, PyPI and npm, AI API keys and databases.
- Check your cloud provider for unusual usage, especially of model services.
- If customers' personal data was exposed, assess the GDPR notification duty with your DPO or adviser.
What it means for a small business
This attack didn't exploit a sophisticated flaw. It started with a key left in a public repository for almost five months and ended with an approval control relaxed in a hurry. Any small team could make both mistakes this week.
The practical lesson cuts two ways. As a software consumer, you can't audit every project you depend on, but you can limit the damage: pin versions, pin images by digest rather than tag, and avoid latest in production. As a producer, revoke any leaked key even if you think nobody saw it, and use short-lived credentials instead of long-lived keys. A developer laptop with a .env full of production keys is exactly what this malware hunts for.
The 4.5 hours it took the attackers to use what they stole sets the pace: if you were hit, rotating tomorrow may be too late. If nobody on your side can check this, it's time to get cybersecurity help.
FAQ
Is uninstalling LiteLLM 1.107.0 enough?
No. The malware loads when Python starts through cook.pth and sitecustomize.py, and can survive deleting the application. Isolate the machine and rotate credentials.
Am I affected if I use LiteLLM enterprise?
According to LiteLLM, enterprise customers using its private registry are not affected.
Why should I check my cloud bill?
Because Wiz saw the attackers query Bedrock models with stolen credentials. That fraudulent usage is charged to the victim.
Sources
- The Hacker News – Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline
- The Hacker News – LiteLLM Suspects GitHub Token Leak in AI Gateway Logs Behind Malicious Package Release
- BleepingComputer – LiteLLM release pipeline hacked to distribute info-stealer malware
- SecurityWeek – LiteLLM Compromised in Fresh Supply Chain Attack
