Unrevoked LiteLLM key enabled credential-stealing supply-chain attack

LiteLLM traced a supply-chain attack against its users to a master key accidentally exposed in May and never revoked. The open-source AI tool’s developers removed the configuration file containing the key after discovering the exposure, but left the credential active. An unidentified attacker later used it to access internal tooling and obtain an access token granting control over all of LiteLLM’s GitHub repositories.

The attacker distributed a release containing credential-harvesting malware through the Python Package Index (PyPI). Cloud security company Wiz said the compromised package was downloaded about 49,000 times and remained available for about two hours. Stolen cloud credentials were being tested within hours, including checks on which Amazon AI models compromised AWS accounts could access. Wiz linked that behavior to “LLMjacking,” where criminals run AI services using stolen cloud accounts and leave victims with the bill. No affected organization has publicly confirmed a breach linked to the release.

Microsoft said the malware could run whenever Python started on an infected computer, even when the program did not use LiteLLM. LiteLLM warned anyone who installed the compromised version (1.107.0) on an internet-connected computer to assume their credentials were stolen and replace every password and access key the machine could reach. The project also said it was revoking tokens across internal systems and vendor platforms.