LiteLLM PyPI Package and Docker Images Compromised to Steal Cloud and AI Credentials

The LiteLLM PyPI package and Docker images for version 1.107.0 were compromised via a supply chain attack. The attacker used a lookalike repository (Berri-AI/litellm instead of BerriAI/litellm) in the release workflow to insert malicious Python startup files that execute automatically upon Python initialization. These files steal a wide range of sensitive credentials including cloud service credentials (AWS, Azure, Google Cloud), GitHub CLI tokens, SSH keys, npm and PyPI configurations, and AI development tool credentials (Claude, Gemini, Cursor). The stolen data is encrypted and exfiltrated to a command-and-control server. Additionally, a separate loader mechanism allows remote execution of arbitrary Python code. Detection occurred within seven minutes of publication by Socket's AI scanner. The attack affects both PyPI packages and Docker images, impacting a widely used package with about 23 million weekly downloads.

The compromise enables attackers to steal highly sensitive credentials and authentication tokens across multiple cloud platforms, developer tools, and AI services. This can lead to unauthorized access to cloud environments, source code repositories, private keys, and AI development resources. The remote code execution capability further increases the risk by allowing attackers to execute arbitrary code within affected environments. Given the high download volume of the compromised package, the potential for widespread credential theft and subsequent attacks is significant.

No official patch or remediation guidance is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should immediately stop using LiteLLM version 1.107.0 and verify the integrity of their credentials and keys potentially exposed. It is recommended to rotate all affected credentials and tokens, including cloud service keys, SSH keys, and AI tool authentications. Monitor for suspicious activity related to these credentials. Avoid installing or deploying the compromised package version and verify package sources carefully to prevent supply chain attacks.