Rotate secrets now: Malware in LiteLLM 1.107.0 steals cloud keys and browser data via supply chain breach
Malicious code in LiteLLM 1.107.0 steals cloud keys and browser data. Users must assume exposure and rotate secrets immediately.
Key points
- LiteLLM version 1.107.0 contains malware that harvests cloud credentials, private keys, and AI provider tokens.
- The attack reached both PyPI wheels and Docker images via a supply chain compromise involving a lookalike repository.
- Socket’s automated scanning identified the malicious payloads seven minutes after the version was published to public registries.
Developers and security teams using LiteLLM version 1.107.0 are affected by a supply chain attack that installs credential-stealing malware. This release, available on PyPI and in Docker Hub, contains malicious Python startup files. These files operate independently of the main application, meaning they can activate whenever a Python environment starts, even if the compromised library is not directly imported by the user’s code.
Root cause
The compromise originated from a manipulated release workflow that recorded a source repository differing by a single hyphen from the legitimate project. According to Socket’s investigation, the container build provenance documents explicitly list `Berri-AI/litellm` as the source, whereas the official repository is `BerriAI/litellm`. This discrepancy indicates that the build process pulled code from an unauthorized, lookalike repository rather than the trusted upstream source.
Attack path
Malicious files named `cook.pth`, `cook.py`, and `sitecustomize.py` were injected into the build artifacts. These files function as a credential stealer and a loader capable of executing remotely supplied Python code. The malware targets cloud credentials, private keys, browser data, and authentication files for AI development tools. Socket’s AI scanner flagged the seven distributed wheel files shortly after publication, confirming the presence of both the stealer and the remote execution loader.
Affected versions
- LiteLLM version 1.107.0 on PyPI
- LiteLLM version 1.107.0 Docker images
- Seven specific wheel artifacts for macOS, Linux, and Windows platforms distributed under version 1.107.0
Mitigation
- Stop deploying or running any environments using LiteLLM version 1.107.0 immediately.
- Rotate all cloud credentials, API keys, and private keys that were accessible to systems where this version was installed.
- Investigate CI runners and proxy containers for signs of unauthorized activity or remote code execution following the installation.
- Rebuild affected container images from verified, clean source code rather than pulling the compromised image layers.
For customers and users
When a supply chain incident compromises a widely used library, teams usually assume that any secret accessible to the runtime environment has been harvested. Employees should check their local machines and cloud consoles for unfamiliar access tokens or new service principals. Users must look out for follow-up scams that reference this specific incident to trick them into revealing new credentials. Do not click links in emails claiming to provide a fix or a security report. Verify any communication regarding this compromise through official, independent channels rather than replying to unsolicited messages.
What to do and how to stay safe: LiteLLM
- Audit your dependency list to confirm whether version 1.107.0 is present in any production or development environments.
- Review cloud provider logs for unexpected API calls or data exfiltration events originating from servers that hosted the compromised library.
- Enforce strict isolation for CI/CD pipelines to prevent malicious payloads from persisting in build artifacts or container layers.
- Monitor network traffic for connections to unknown external endpoints that may indicate the remote code execution loader is active.
Step-by-step guide: Passkeys Explained: How Passwordless Login Actually Works
General security guidance from the DarkWeb Headlines newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Does the malware require the LiteLLM library to be imported to activate?
No, the malicious startup files can activate whenever a Python environment starts, even if the application does not directly import the compromised library.
How was the malicious code introduced into the release?
The build process recorded a lookalike repository named Berri-AI/litellm, differing by one hyphen from the legitimate BerriAI/litellm source.
Is there a confirmed fix or patch available yet?
The source material does not state that a patched version has been released; users should avoid version 1.107.0 and investigate affected environments.
