LiteLLM supply chain attack spreads credential-stealing malware via PyPI, Docker

Unknown attackers compromised the release pipeline for LiteLLM, a popular open source AI gateway with approximately 23 million weekly downloads, on Wednesday. They distributed malicious version 1.107.0 through PyPI and Docker Hub/GHCR containing malware that steals cloud credentials, AI service API keys, browser data, and SSH keys, plus a RAT enabling remote code execution. PyPI quarantined the package within hours and Docker images were removed, but users who ran the compromised version should assume secrets were stolen. The safe version is v1.106.2.

How the LiteLLM compromise worked

• Attackers used a hyphenated typosquatting organization github.com/Berri-AI/litellm to inject malicious commits into the release pipeline
• Three malicious files were planted: cook.pth (Python path hook), cook.py (infostealer), and sitecustomize.py (RAT)
• cook.pth auto-executes cook.py every time Python starts; sitecustomize.py also runs at interpreter startup as a background daemon
• The infostealer operates across 16 modules targeting browsers (Chrome, Firefox, Edge, Safari), cloud providers (AWS, GCP, Azure), and AI services (OpenAI, Anthropic, Cohere)
• Stolen data is encrypted with AES-256-CBC, key wrapped with RSA-4096, and exfiltrated via HTTP POST to www.litellm.dev/healthcheck
• The RAT daemon polls attacker infrastructure hourly for new commands
• IOCs: /tmp/.pc_once_* (exfiltration occurred) and /tmp/remote_code_loader.lock (C2 active or was active)

Why it matters

Given LiteLLM's role as a unified API gateway for multiple LLM providers and its 23 million weekly downloads, the compromise exposes a critical supply chain vector for AI infrastructure. Organizations running the malicious version likely leaked cloud identities, database connections, and LLM API keys—credentials that could enable further lateral movement and unauthorized AI service access.