Rotate Cloud Keys After LiteLLM 1.107.0 Supply Chain Compromise
A compromised LiteLLM release distributed credential stealers and remote access trojans. Users of version 1.107.0 must assume their secrets are exposed and rotate them immediately.
Key points
- LiteLLM version 1.107.0 was compromised via stolen GitHub tokens, distributing malware that steals cloud credentials and AI keys.
- The malicious payload includes a credential stealer named privcollect and a background daemon that executes arbitrary code from a remote server.
- PyPI has quarantined the package and Docker images have been removed, but any system that ran the version should be treated as compromised.
Developers using the LiteLLM Python package face immediate credential exposure risks after a supply chain attack targeted version 1.107.0. Security researchers from SafeDep, Socket, StepSecurity, and Upwind reported that the compromised release delivered a credential stealer and a backdoor to users who installed it. The malware is designed to harvest sensitive data, including cloud credentials, private keys, and authentication files for AI development tools. This means anyone who installed the specific version may have had their secrets exfiltrated without their knowledge.
Root cause
The compromise originated from stolen GitHub CLI OAuth tokens belonging to three engineers at LiteLLM. According to Oliver Jensen, director of security at LiteLLM, the threat actor used these tokens to trigger and approve a malicious release run. The investigation is ongoing, and the exact method used to acquire the tokens remains unknown. Jensen stated that all involved tokens have been revoked. As a temporary measure, LiteLLM removed all but one unaffected user from its GitHub organization to limit further access.
Attack path
The malicious code executed before LiteLLM was even imported, using a path file named cook.pth. This file triggers automatic execution when the Python interpreter starts. StepSecurity identified two main payloads: a credential stealer called privcollect and a background daemon. The daemon checks a GitHub dead drop every hour and runs any Python code the attacker serves. This remote access trojan allows the attacker to execute arbitrary commands on infected machines, providing persistent control over the compromised systems.
Affected versions
Only LiteLLM version 1.107.0 is affected by this specific compromise. The malicious code was distributed through PyPI wheels and Docker images. The following specific wheel files contain the payload:
- litellm-1.107.0-cp310-abi3-macosx_10_12_x86_64.whl
- litellm-1.107.0-cp310-abi3-macosx_11_0_arm64.whl
- litellm-1.107.0-cp310-abi3-manylinux_2_28_aarch64.whl
- litellm-1.107.0-cp310-abi3-manylinux_2_28_x86_64.whl
- litellm-1.107.0-cp310-abi3-musllinux_1_2_aarch64.whl
- litellm-1.107.0-cp310-abi3-musllinux_1_2_x86_64.whl
The source archive litellm-1.107.0.tar.gz also contains a tampered pyproject.toml file.
Mitigation
PyPI has quarantined the malicious package, and the Docker images have been removed from Docker Hub and GHCR. LiteLLM has updated public registries to remove trusted links to its GitHub organization. Users should check their systems for specific indicators of compromise. Aikido Security researcher Ilyas Makari advised looking for /tmp/.pc_once_* files, which indicate exfiltration has occurred. The presence of /tmp/remote_code_loader.lock indicates the command-and-control daemon is running or has run.
For customers and users
When a supply chain compromise occurs, assume all secrets stored in the affected environment are exposed. Teams should immediately rotate any API keys, cloud credentials, or private keys that were accessible to the compromised application. Check for unusual outbound network connections that might indicate data exfiltration. Review access logs for any suspicious activity following the installation. Be vigilant for follow-up phishing attempts that reference the incident to trick users into revealing new credentials. Treat any account accessed from the compromised system as potentially breached.
Background: Credential exposure
Credential exposure occurs when login identifiers and secrets become accessible to unauthorized parties. This happens through breaches, leaks, or weak storage. It allows attackers to impersonate you, access accounts, and pivot into broader networks without needing to break new encryption.
Read the full guide: Credential Exposure: Meaning, Sources, and Real-World Impact
What to do and how to stay safe: LiteLLM
- Rotate all cloud credentials, private keys, and AI provider API keys that were accessible to the LiteLLM application.
- Scan systems for the specific indicator files mentioned by security researchers to confirm if the malware executed.
- Monitor network traffic for connections to unknown external servers, which could indicate the remote access trojan is active.
- Update LiteLLM to a version released after 1.107.0 once the vendor confirms the release process is secured.
Step-by-step guide: Passkeys Explained: How Passwordless Login Actually Works
General security guidance from the DarkWeb Headlines newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Does LiteLLM version 1.107.0 contain malware?
Yes, version 1.107.0 contains a credential stealer and a remote access trojan that execute automatically when the Python interpreter starts.
How did the attacker compromise the LiteLLM package?
The attacker used stolen GitHub CLI OAuth tokens from three engineers to trigger and approve the malicious release through the project-releaser workflow.
Are the malicious Docker images still available?
No, the malicious Docker images have been removed from both Docker Hub and GHCR, and the PyPI package has been quarantined.
