Compromised LiteLLM release pipeline pushes credential-stealing malware to PyPI and Docker
The malicious version 1.107.0 was live on PyPI for about two hours and stole cloud credentials, developer secrets and AI provider keys.
Evidence: Official disclosure. Security stories run only with a named disclosure or independent reporting behind them.
LiteLLM, a widely used open-source gateway for calling AI models, says its release pipeline was compromised early on October 21. The attacker published a malicious version, 1.107.0, to PyPI and Docker. According to the company's incident report, the PyPI package was live from 11:39 to 13:23 UTC. The Docker images tagged v1.107.0, latest, main-latest and main-stable were compromised from 11:46 to 14:20 UTC. The v1.107.0 image has been removed, and the other tags now point to secure sources. LiteLLM says all earlier versions are safe and that customers on its private enterprise release were not affected. The company says the attacker had to get past several independent security controls. The Hacker News reports that LiteLLM suspects a GitHub token leaked in AI gateway logs. Socket's analysis found malicious Python startup files that run whenever Python starts, even if LiteLLM is never imported. They collect cloud credentials, private keys, browser data and login files for AI development tools, and they include a loader that can run Python code sent remotely and controlled through a GitHub file. Socket says its scanner flagged the seven wheels seven minutes after they were published. Developers who installed the affected version should treat their credentials as exposed.