Hackers Inject Credential-Stealer, RAT Into LiteLLM

Attackers compromised a version of LiteLLM this week by injecting malicious code into all seven of its published Python wheels on PyPI, delivering a package that included an infostealer to exfiltrate credentials and secrets and a remote access trojan (RAT) that could let bad actors run arbitrary code on infected machines.

The compromised version – 1.107.0 – was published to the Python Package Index (PyPI) on October 21, and the same payload was shipped in the official LiteLLM Docker images.

The attack was quickly detected, identified, and dealt with. For example, Socket researchers wrote that their scanners detected the malware seven minutes after publication. PyPI quarantined and removed version 1.107.0, and the Docker image – litellm/litellm:1.107.0 – was removed from both Docker Hub and GHCR, according to Aikido researchers. In addition, GitHub took down a dead-drop repository that the RAT used to get its command-and-control (C2) domain.

Incident Quickly Contained

LiteLLM executives wrote later in the day that the incident was contained and that they had likely discovered the attack chain. They noted that in March, LiteLLM hardened its CI release pipeline, saying they “moved releases to a private repo, have a strict set of workflows used in order to create them via Trusted GitHub Publishers, made our docker release tags immutable, and are signing docker images.”

On October 19, LiteLLM temporarily expanded the release permissions so two internal engineers could publish daily bugfix backports for users. The attacker had access to three sets of developer GitHub CLI credentials, one of which allowed them to run GitHub workflows.

“The attacker tried to merge a change to allow the releaser to be pointed at a different source repository, but was unable to due to our protections,” they wrote. “One of the tokens held by the attacker belonged to one of our two GitHub organization owners. The attacker used this to disable branch protections and force push the change.”

A Lookalike Repository

That allowed them to eventually run the compromised workflow that was pointed at a lookalike repository – Berri-AI/litellm rather than BerriAI/litellm – which signed and published the malicious artifacts.

The LiteLLM executives also said they found a particular situation in which Claude Code will embed a user’s GitHub CLI OAuth token in a response body. Where response bodies are logged, the tokens can appear in LiteLLM logs.

In addition, they identified an unexpected named user account in the LiteLLM deployed internally and that was exposed to the public internet.

“We believe the attacker gained access to this deployment, obtained the GitHub CLI OAuth tokens from its logs, and subsequently used those credentials to compromise our release workflow,” they wrote.

AI-Enabled Attack

The payload itself has “strong indications of LLM-aided development,” according to researchers with Google-owned Wiz. Some of the clues include what they describe as verbose variable names – in this case, encrypted_private_key_output – and overly defensive error handling through generic try/except blocks, platform-specific code paths that silently fail on untested platforms. There also is a dead code module that was defined but never called.

“The structure suggests iterative prompting: functional on the happy path but brittle at the edges and untested,” they wrote in a report.

The embedded infostealer – named “privcollect” – steals data from 16 modules, including browser credentials and cookies from Chrome, Firefox, Edge, and Safari, Amazon Web Services credentials and EC2 and EDS instance metadata, Google Cloud Platform service account keys and application default credentials, and Azure tokens from the CLI cache.

It also looks for API keys for a host of LLM providers – including OpenAI, Anthropic, and Cohere – and collects SSH private keys, GPG keys, and shell history files.

Growing Threat to AI Infrastructure Layer

This is the second time this year that LiteLLM was the target of a supply-chain attack. It was compromised in March, eventually rolling up more than 2,500 companies – including some top-tier IT and AI companies as well as cybersecurity and SaaS firms – and exposed about 434,000 CI/CD pipelines.

It’s unlikely to be the last. Threat actors are seeing the AI infrastructure layers as attractive targets, given the emerging central role they play in enterprises, including holding specialized hardware, data pipelines, and orchestration frameworks.

LiteLLM is an open-source AI gateway and abstraction layer that translates requests across more than 140 LLM providers – OpenAI, Anthropic, Google Gemini, and AWS Bedrock included – into a single API. Hackers who breach it could give them a single point of access to grab the key to the entire AI stack of an enterprise.