LiteLLM 1.107.0 Compromised in Supply Chain Attack Stealing Cloud and AI Credentials
Malicious code in LiteLLM version 1.107.0 steals cloud credentials and AI keys via Python startup hooks, affecting both PyPI packages and Docker images.
Key points
- LiteLLM 1.107.0 contains malware that harvests cloud credentials, private keys, and AI provider authentication files.
- Container build provenance reveals the malicious release used a lookalike source repository named Berri-AI/litellm.
- Socket’s scanner flagged the compromised wheels seven minutes after they were published to PyPI.
Researchers at Socket identified a supply chain attack targeting LiteLLM version 1.107.0 on October 21, 2026. The compromised release, available on PyPI and Docker, installs malware designed to steal cloud credentials, developer secrets, and artificial intelligence provider keys from victim systems.
The malicious package includes Python startup files that activate credential-stealing routines during normal Python initialization. Static analysis confirms the presence of both a data exfiltration tool and a loader capable of executing remotely supplied code. This means the malware runs even if the application does not explicitly import the LiteLLM library.
Build Provenance and Delivery Mechanism
Investigation into the Docker image reveals that the release workflow recorded a source repository with a subtle typo. The provenance documents list the source as Berri-AI/litellm, which differs by one hyphen from the legitimate BerriAI/litellm project. This discrepancy suggests the attackers injected the payload through a compromised or manipulated build process.
The malicious build began at 10:51:23 UTC and completed at 11:06:31 UTC on October 21, 2026. Commits added to the build configuration included a data directory containing the startup payloads. These changes were not present in the tagged release’s pyproject.toml, meaning a simple review of the tag would have missed the packaging alteration.
Impact on Users and Infrastructure
LiteLLM serves as a common interface for large language model providers and sees approximately 23 million weekly downloads. A compromised installation runs alongside sensitive data such as API keys, cloud identities, and database connection strings. This exposure affects proxy containers, CI runners, and any environment where Python executed after the package was installed.
Researcher kaba previously found that compromised Tor exit relays redirected SSH traffic to steal credentials, illustrating broader risks to developer infrastructure. The current LiteLLM incident targets the software supply chain directly, embedding the threat within the package itself rather than intercepting network traffic.
What should you do?
Teams using LiteLLM 1.107.0 must stop deploying this version immediately. They should investigate all environments where Python ran after installation, including containerized proxies and continuous integration runners. Socket’s AI scanner detected the threat quickly, but manual verification is required for systems that may have already executed the malicious code.
Background: Large language models
Large language models are a specific type of neural network trained on text. Generative AI is the broader umbrella term for any system that creates new content, including images and code. Not all generative AI uses large language models, but most modern text generators do.
What to do and how to stay safe: LiteLLM
- Audit all systems for the presence of LiteLLM version 1.107.0 and remove it if found.
- Rotate all cloud credentials, private keys, and AI provider API keys that were accessible to affected systems.
- Review container build provenance and source repositories for unauthorized changes or lookalike names.
- Monitor for unusual outbound network traffic or new authentication tokens generated from compromised environments.
Step-by-step guide: Social Engineering Warning Signs and How to Respond
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How did the attackers inject the malware into LiteLLM?
Build provenance shows the release used a lookalike source repository named Berri-AI/litellm, differing by one hyphen from the legitimate project.
Does the malware require the application to import LiteLLM to run?
No, the malicious Python startup files activate during normal Python initialization, running even without explicit imports.
When was the malicious build created?
The build started at 10:51:23 UTC and finished at 11:06:31 UTC on October 21, 2026.
