By Hamza Faisal

The open-source package that lets developers call every AI model through one API just became a credential thief. On October 21, version 1.107.0 of LiteLLM — a widely used gateway for routing requests across AI model providers — was published to PyPI and Docker Hub carrying a credential stealer and a remote-access backdoor, according to reports from Wiz, StepSecurity, Socket and SafeDep.

LiteLLM sits at the heart of many AI stacks: its proxy holds the API keys for every model provider a company uses, which makes it a prime target. Anyone who downloaded an unpinned version of LiteLLM between 11:39 a.m. and 1:23 p.m. UTC via pip, or pulled the Docker images (v1.107.0, latest, main-latest or main-stable) between 11:46 a.m. and 2:20 p.m. UTC, may have been exposed.

A stealer that runs before you even import anything

The poisoned release's nastiest trick is how early it runs. The package shipped a file called cook.pth, which the Python interpreter executes automatically at startup — even if the LiteLLM library is never imported. That file imports cook.py, a script that deobfuscates itself and runs a stealer routine dubbed “privcollect.”

Privcollect harvests cloud tokens, private keys, browser data from Chromium and Firefox, environment variables, AI tooling credential files and the provider keys stored by a LiteLLM proxy — then exfiltrates the haul as a compressed archive to a LiteLLM-lookalike domain via HTTP POST. A second-stage loader, sitecustomize.py, runs only on Linux and macOS: it forks a background daemon that checks a now-removed GitHub dead drop every hour for attacker-controlled Python code to execute. The dead drop only held test values before GitHub took it down, and StepSecurity reports that stage was never armed.

Wiz, the Google-owned cloud security company, called the dual technique — .pth files plus sitecustomize.py in one package — the first documented case in the wild. Its researchers Benjamin Read and Rami McCarthy confirmed the analysis.

Attackers stole engineers' GitHub tokens to ship it

The most alarming part is how the poisoned release got out. Oliver Jensen, LiteLLM's director of security, said the attacker operated through three engineers' GitHub accounts using stolen GitHub CLI OAuth tokens: one account triggered the project-releaser workflow, another approved it. The git tag itself was clean — the malware existed only in the built packages — and StepSecurity traced the release workflow to a lookalike repository named “Berri-AI/litellm,” spelled with a hyphen.

LiteLLM now suspects the tokens were lifted from its own AI gateway logs, where a coding tool can embed a user's token inside a logged response — though how the attacker reached the exposed deployment is still unknown. The company has revoked all involved tokens, temporarily removed everyone but one unaffected user from its GitHub organization, and stripped trusted links to its GitHub org from public registries.

The second supply-chain hit this year — rotate everything

This is the second time LiteLLM has been backdoored on PyPI this year: in March, versions 1.82.7 and 1.82.8 shipped malware in an incident attributed to the group TeamPCP. Chainguard and Socket say there is no evidence linking this attack to TeamPCP.

If you installed 1.107.0 or pulled the affected images, uninstalling is not enough — any Python process, including pip itself, re-triggers the payload on an infected environment. Security firms advise treating the machine as compromised, revoking and rotating every exposed credential from a clean environment, rebuilding virtual environments from scratch, and pinning litellm==1.106.2 by digest. Docker users should pin image digests instead of floating tags like latest.

By Hamza Faisal