LiteLLM release compromised to steal credentials and enable remote access

Attackers compromised LiteLLM’s release process, distributing version 1.107.0 through PyPI and Docker registries with an infostealer and a remote access trojan. PyPI quarantined the package within hours, while the affected Docker image was removed from Docker Hub and GHCR soon afterward. The most recent safe version is v1.106.2, according to security researchers.

The compromised AI gateway targeted browser passwords and cookies, cloud credentials, LLM provider API keys, SSH private keys, GPG keys, and shell histories. LiteLLM provides a common interface for services including OpenAI, Anthropic, and Google Gemini, and receives about 23 million weekly downloads. Its proximity to cloud identities and application secrets makes infected installations a potentially valuable source of stolen credentials.

Researchers traced the payload to malicious commits in a repository under Berri-AI, a hyphenated variant of the legitimate BerriAI organization. Files injected into the release pipeline caused the infostealer and remote access trojan to run automatically when Python started. The trojan launched a background daemon that checked attacker infrastructure every hour for commands.

Security teams advise stopping deployment of the affected release and investigating environments where Python ran after installation, including proxy containers and CI runners. Users who ran the compromised package or affected official Docker image should assume secrets were stolen. Aikido, Wiz, and Socket have published threat-hunting and mitigation guidance. The scale of the compromise remains unknown.