Оригинальный текст на языке EN взят с сайта-источника. Источник ↗

LiteLLM was compromised in a fresh supply chain attack, and malicious packages were served to its users on both PyPI and Docker.

The incident occurred on October 21 and involved version 1.107.0 of the popular open source proxy for routing requests across LLM providers.

The malicious packages were online for roughly three hours and are estimated to have been downloaded over 49,000 times. The packages were removed from PyPI, and Docker Hub tags and image variants were either removed or repointed to clean artifacts.

[Read: Trivy, Not LiteLLM Behind the 2,500 Org Compromise ]

Per LiteLLM’s investigation, the attackers obtained the GitHub CLI OAuth tokens for “an unexpected, innocuously named user account in our internal LiteLLM deployment, which was exposed to the public internet”.

The tokens were likely leaked by Claude Code, which, in specific circumstances, would embed them into a response body, which may be logged to LiteLLM logs. The attackers likely retrieved the tokens from the logs.Advertisement. Scroll to continue reading.

However, it is still unclear how the attackers accessed the internal deployment or moved laterally, as they had access to three sets of developer GitHub CLI credentials, LiteLLM says.

The attackers used the compromised credentials to disable branch protections, merge a change that pointed the releaser to a different source repository, and run a compromised GitHub workflow that pointed to a lookalike repository, then signed and published the poisoned artifacts.

Users who downloaded the malicious LiteLLM version 1.107.0 packages during the compromise window were infected with malware that serves as an information stealer and a RAT. According to LiteLLM, its enterprise customers pulling from its private repository were not affected.

Likely built with the help of AI and served from Berri-AI/litellm, which poses as the legitimate BerriAI/litellm repository, the payload extracts three files into the site-packages root to be executed whenever a Python interpreter runs.

First, the interpreter loads the stealer, which harvests system information, browser credentials and cookies, developer credentials, environment variables, cloud secrets (AWS, GCP, and Azure), AI tool API keys (Anthropic, GitHub Copilot, OpenAI, and more), SSH private keys, shell history files, and GPG keys.

The stolen data is encrypted and sent to litellm[.]dev.

Cybersecurity outfit Wiz says the attackers started abusing the stolen credentials roughly 4.5 hours after they were exfiltrated.

Wiz observed the attackers querying Amazon Bedrock models with stolen AWS credentials, suggesting LLMjacking.

The RAT component of the malware was observed regularly checking with the attackers’ command-and-control (C&C) server. It also “checks a GitHub dead drop every hour and runs whatever Python the attacker serves,” StepSecurity notes.

Users who installed LiteLLM version 1.107.0 should immediately remove it, rotate their credentials, and sweep their systems for malware. The most recent clean LiteLLM version is 1.106.2.

Related: AOMEI Backupper Compromised in Short-Burst Supply Chain Campaign

Related: Rank Math PRO WordPress Plugin Compromised in Supply Chain Attack

Related: $86 Million Crypto Heist Linked to Ledger Signer Hardware Implant

Related: Long-Running NPM Malware Campaign Accumulates 40,000 Downloads

Written By Ionut Arghire

Ionut Arghire is an international correspondent for SecurityWeek.

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights.

More from Ionut Arghire

PHP2Shell Exploitation Started Days Before Patches PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors Memory Bugs Account for Most of Chrome’s 353 New Security Fixes Browsers Block eMudhra Intermediate CAs Over Recoverable Private Keys Chinese AI Model Writes More Hackable Code When Told It’s for US Contractor PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP Flaws AOMEI Backupper Compromised in Short-Burst Supply Chain Campaign Ahold Delhaize Restoring Services Disrupted by Cyberattack

Latest News

Atlassian Patches 75 Flaws in Data Center and Server Products Iran’s Prince of Persia APT Hosts C&C in US for First Time Since 2016 Hacker Conversations: Corey Thuen and the Evil Bit Indurex Raises $8 Million to Expand Industrial Cybersecurity Platform Signal Vulnerability Lets Malicious Callers Block Hang-Ups Tech and Security Companies Respond to PHP2Shell Vulnerabilities Splunk, SolarWinds Release Fresh Security Updates Cisco Patches 34 Vulnerabilities Across Multiple Products

Trending

PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP Flaws

PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors

Tech and Security Companies Respond to PHP2Shell Vulnerabilities

Chinese AI Model Writes More Hackable Code When Told It’s for US Contractor

Signal Vulnerability Lets Malicious Callers Block Hang-Ups

Cisco Patches 34 Vulnerabilities Across Multiple Products

PHP2Shell Exploitation Started Days Before Patches

Google Hardens Chrome Against ClickFix Attacks, Insecure HTTP Connections

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Webinar: The AI Access Risk Already in Your Google Workspace

October 19, 2026

AI tools connected to Google Workspace can access millions of sensitive emails and files. Join this session to uncover your organization’s risk and learn a framework to manage AI access.

Register

Virtual Event: CISO Forum 2026 Summit

November 10 & 11, 2026

Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.

Register

People on the Move

Jon Steinbach has been appointed strategic technical advisor to the Pentagon’s CIO.

Vasu Jakkal has joined Armadin as CSBO.

Ivanti has named Robert Ruelas as CRO and Sterling Parker as CCO.

More People On The MoveExpert Insights

The Key to AI Software Security Isn’t Speed, It’s Maturity

Where your developers sit on the AI adoption scale has a real impact on how you are addressing security risk. (Matias Madou)