Hacker Inject Credential-Stealer, RAT Into LiteLLM
This incident matters less as an isolated package compromise than as a warning about where AI-platform concentration creates asymmetric risk. LiteLLM sits in front of many model providers and often handles provider keys, cloud credentials, logs, routing metadata, and developer workflows. That makes an AI gateway a high-value control plane: compromise one layer and an attacker may pivot across inference, CI/CD, cloud accounts, and developer endpoints at once.
For practitioners, the immediate question is not only whether version 1.107.0 was deployed, but whether the gateway was treated as a trusted internal utility rather than a hardened security boundary. Teams using LLM gateways should assume they are secret-dense services and apply controls accordingly: short-lived credentials where possible, strict egress controls, runtime isolation, immutable releases, provenance verification for packages and containers, and detection for unusual access to browser stores, cloud metadata endpoints, and local key material.
The release-chain details also highlight a common governance gap: strong pipeline controls can still be bypassed if human tokens, workflow permissions, and logging practices are not equally constrained. In practical terms, IT teams should review whether OAuth tokens appear in logs, whether GitHub workflow permissions are broader than necessary, and whether production-facing internal services expose administrative footholds to the public internet.
More broadly, AI infrastructure components now deserve the same supplier-risk treatment already applied to identity, CI runners, and observability agents. If an LLM abstraction layer is multi-tenant inside your environment, segment it accordingly; otherwise, a convenience layer can become a blast-radius multiplier.
Attackers compromised a version of LiteLLM this week by injecting malicious code into all seven of its published Python wheels on PyPI, delivering a package that included an infostealer to exfiltrate credentials and secrets and a remote access trojan (RAT) that could let bad actors run arbitrary code on infected machines.
The compromised version – 1.107.0 – was published to the Python Package Index (PyPI) on October 21, and the same payload was shipped in the official LiteLLM Docker images.
The attack was quickly detected, identified, and dealt with. For example, Socket researchers wrote that their scanners detected the malware seven minutes after publication. PyPI quarantined and removed version 1.107.0, and the Docker image – litellm/litellm:1.107.0 – was removed from both Docker Hub and GHCR, according to Aikido researchers. In addition, GitHub took down a dead-drop repository that the RAT used to get its command-and-control (C2) domain.
Incident Quickly Contained
LiteLLM executives wrote later in the day that the incident was contained and that they had likely discovered the attack chain. They noted that in March, LiteLLM hardened its CI release pipeline, saying they “moved releases to a private repo, have a strict set of workflows used in order to create them via Trusted GitHub Publishers, made our docker release tags immutable, and are signing docker images.”
On October 19, LiteLLM temporarily expanded the release permissions so two internal engineers could publish daily bugfix backports for users. The attacker had access to three sets of developer GitHub CLI credentials, one of which allowed them to run GitHub workflows.
“The attacker tried to merge a change to allow the releaser to be pointed at a different source repository, but was unable to due to our protections,” they wrote. “One of the tokens held by the attacker belonged to one of our two GitHub organization owners. The attacker used this to disable branch protections and force push the change.”
A Lookalike Repository
That allowed them to eventually run the compromised workflow that was pointed at a lookalike repository – Berri-AI/litellm rather than BerriAI/litellm – which signed and published the malicious artifacts.
The LiteLLM executives also said they found a particular situation in which Claude Code will embed a user’s GitHub CLI OAuth token in a response body. Where response bodies are logged, the tokens can appear in LiteLLM logs.
In addition, they identified an unexpected named user account in the LiteLLM deployed internally and that was exposed to the public internet.
“We believe the attacker gained access to this deployment, obtained the GitHub CLI OAuth tokens from its logs, and subsequently used those credentials to compromise our release workflow,” they wrote.
AI-Enabled Attack
The payload itself has “strong indications of LLM-aided development,” according to researchers with Google-owned Wiz. Some of the clues include what they describe as verbose variable names – in this case, encrypted_private_key_output – and overly defensive error handling through generic try/except blocks, platform-specific code paths that silently fail on untested platforms. There also is a dead code module that was defined but never called.
“The structure suggests iterative prompting: functional on the happy path but brittle at the edges and untested,” they wrote in a report.
The embedded infostealer – named “privcollect” – steals data from 16 modules, including browser credentials and cookies from Chrome, Firefox, Edge, and Safari, Amazon Web Services credentials and EC2 and EDS instance metadata, Google Cloud Platform service account keys and application default credentials, and Azure tokens from the CLI cache.
It also looks for API keys for a host of LLM providers – including OpenAI, Anthropic, and Cohere – and collects SSH private keys, GPG keys, and shell history files.
Growing Threat to AI Infrastructure Layer
This is the second time this year that LiteLLM was the target of a supply-chain attack. It was compromised in March, eventually rolling up more than 2,500 companies – including some top-tier IT and AI companies as well as cybersecurity and SaaS firms – and exposed about 434,000 CI/CD pipelines.
It’s unlikely to be the last. Threat actors are seeing the AI infrastructure layers as attractive targets, given the emerging central role they play in enterprises, including holding specialized hardware, data pipelines, and orchestration frameworks.
LiteLLM is an open-source AI gateway and abstraction layer that translates requests across more than 140 LLM providers – OpenAI, Anthropic, Google Gemini, and AWS Bedrock included – into a single API. Hackers who breach it could give them a single point of access to grab the key to the entire AI stack of an enterprise.
Enjoyed this article? Sign up for our newsletter to receive regular insights and stay connected.