Attackers pushed a malicious version of LiteLLM, an open-source gateway that companies use to route requests to many different AI models, through the project's official release pipeline Wednesday, delivering malware that steals passwords, cloud credentials and AI provider keys, The Register reported. Because a gateway like LiteLLM typically holds the keys to every AI service a company uses and runs with access to its cloud account, LiteLLM told anyone who installed the release to assume their secrets were stolen.
What Happened
According to LiteLLM's incident report, version 1.107.0 was live on PyPI, the main public registry for Python software, from 11:39 to 13:23 UTC on Oct. 21. Docker Hub tags for v1.107.0, latest, main-latest and main-stable pointed to compromised container images from 11:46 to 14:20 UTC, and the same tags on GitHub's container registry were unavailable by 13:51 UTC. The project says the official source code tag was clean: the packages were built from a lookalike repository, Berri-AI/litellm, rather than the legitimate BerriAI/litellm.
LiteLLM said the attacker held GitHub command-line credentials belonging to three developers. One, belonging to an owner of the GitHub organization, was used to override branch protections and change the release workflow; a second satisfied the production approval gate; a third deleted workflow records. Two days earlier, the team had temporarily widened release permissions so two engineers could publish bug-fix updates.
The company said it suspects, but has not confirmed, that the attacker entered an internet-exposed internal LiteLLM deployment through a recently patched vulnerability and collected the tokens from its logs. In a section on token exposure, LiteLLM wrote that it has "observed specific situations" in which the AI coding assistant Claude Code embeds a user's GitHub CLI token in a response body, so the token can land in LiteLLM logs where responses are recorded. The report presents that as a possible exposure path and says the attacker had to defeat several independent security controls.
The malicious release's entry in the OSV open-source vulnerability database says the package adds a file that runs every time Python starts, even if LiteLLM is never used. The Register, citing researchers at Wiz and Aikido Security, reported that the payload pairs an information stealer with a remote-access program that checks attacker servers hourly for new instructions. Targets include browser passwords and cookies; AWS, Google Cloud and Azure credentials; API keys for OpenAI, Anthropic, Cohere and other model providers; and SSH and GPG keys. CSO Online, citing Aikido, added Kubernetes tokens, continuous-integration secrets and the API keys stored in LiteLLM's database.
Why It Matters
LiteLLM gets about 23 million downloads a week, according to The Register. How many installations pulled the bad release is not yet known, and BerriAI, the company behind it, did not respond to The Register.
This is the project's second compromise this year. CSO Online reported that after a March attack, which the project linked to the Trivy security scanner in its release pipeline, LiteLLM moved releases to a private repository and began signing its Docker images. Those steps did not stop this attack because the stolen credentials let the attacker run the real workflow, which signed the malicious build. For boards, the lesson is that a signature confirms where software came from, not that it is safe.
LiteLLM said customers using its private enterprise registry were not affected. Others should pin to version 1.106.2, rebuild affected images and environments from scratch, and rotate cloud roles, every provider key in the proxy database, master and virtual keys, and the database password.
What to Watch
LiteLLM promised updates every two hours. Open questions are how the internal deployment was first breached, how many organizations installed 1.107.0, and whether stolen keys are used against cloud and AI accounts. LiteLLM also said a separate vulnerability, already fixed in its enterprise release, is scheduled for disclosure Oct. 27. Earlier this month, The Primary Wire reported on a botnet targeting exposed LiteLLM servers, a sign that AI gateways are drawing sustained attention from attackers.
