Attackers compromised LiteLLM’s release process on Wednesday and distributed version 1.107.0 through PyPI and Docker registries. The release contained malware designed to steal cloud and AI credentials, plus a remote access trojan capable of running arbitrary code on infected machines.
PyPI quarantined the package within hours. The litellm/litellm:1.107.0 image was removed from Docker Hub and GHCR soon afterward. Anyone who ran the compromised release should assume their secrets were stolen, according to the source reporting.
LiteLLM, developed by BerriAI, gives applications a common interface to LLM providers including OpenAI, Anthropic, and Google Gemini. It receives about 23 million downloads a week. Installations can run alongside provider API keys, cloud identities, and database connection strings.
Read nextGoogle makes SynthID Detector available globallyMalicious files ran when Python started
The malicious version was uploaded at 11:39 UTC. Wiz researchers Benjamin Read and Rami McCarthy traced the payload to malicious commits on github.com/Berri-AI/litellm, a hyphenated variant of the legitimate BerriAI organization. The attackers used that repository to inject three files into the release pipeline.
According to Aikido Security malware hunter Ilyas Makari, cook.pth makes cook.py run whenever Python starts, without further user action. The cook.py file contains the information stealer. A third file, sitecustomize.py, also runs at interpreter startup. It launches a background daemon that checks attacker infrastructure every hour for commands to execute.
Read and McCarthy said the stealer uses 16 modules to collect sensitive data. Targets include credentials and cookies from Chrome, Firefox, Edge, and Safari; AWS credentials from ~/.aws/, environment variables, and EC2/ECS instance metadata; Google Cloud Platform service account keys and application default credentials; and Microsoft Azure tokens from the CLI cache. It also collects API keys for OpenAI, Anthropic, Cohere, and other LLM providers, along with SSH private keys, GPG keys, and shell history.
The malware encrypts the collected data with AES-256-CBC, wraps the encryption key with an RSA-4096 public key, and sends the data by HTTP POST to http://www[.]litellm[.]dev/healthcheck.
Security teams urged users to investigate
“Check for /tmp/.pc_once_* (the exfil has already fired if this file exists) and /tmp/remote_code_loader.lock (the C2 daemon ran or is still running if this file exists),” Makari advised. “The same applies to anyone who ran the official Docker image litellm/litellm:1.107.0 , or pulled it via the latest , main-latest , or main-stable tags.” Aikido, Wiz, and Socket have published threat-hunting and mitigation guidance.
The scale of this attack is not yet known. CloudSEK estimated that an earlier LiteLLM compromise in March potentially exposed more than 2,500 organizations and 434,000 CI/CD pipelines worldwide. BerriAI did not respond to The Register’s inquiries. Socket said teams using 1.107.0 should stop deploying it and investigate environments where Python ran after installation, including proxy containers and CI runners.
