LiteLLM 1.107.0 PyPI release compromised with credential stealer and backdoor
LiteLLM 1.107.0, a popular open-source AI gateway, was compromised on PyPI and Docker registries with a credential stealer and remote code execution backdoor. The malware exfiltrates SSH keys, cloud credentials, and AI tokens to a remote server. PyPI and Docker Hub removed the release within hours. Users of the affected version should assume secrets are stolen, while versions 1.106.2 and later release candidates remain clean.
Key points
- LiteLLM, an open-source AI gateway, released version 1.107.0 on PyPI and Docker registries containing a credential stealer and a remote code execution backdoor.
- The malware installs three files in site-packages, with cook.pth importing a stealer that collects SSH keys, cloud credentials, and AI tokens, sending them to www.litellm[.]dev.
- A background daemon in sitecustomize.py runs hourly, fetching new code from a GitHub file and executing it, allowing persistent remote access.
- PyPI and Docker Hub removed the compromised release within hours, identifying v1.106.2 as the most recent safe version, while 1.107.0rc1 and rc2 are also clean.
- Security firms Aikido, Wiz, and Socket advise users to check for /tmp/.pc_once_* and /tmp/remote_code_loader.lock files to determine if the malware executed.
- This is the second major LiteLLM supply chain attack, following a March compromise that potentially exposed 2,500 organizations and 434,000 CI/CD pipelines.
LiteLLM, a widely used open-source AI gateway, suffered a supply chain compromise when version 1.107.0 was released on PyPI and Docker registries. The malicious release included a credential stealer and a remote code execution backdoor, allowing attackers to exfiltrate sensitive data and maintain persistent access to infected systems. The upstream GitHub source code remained clean, indicating the compromise occurred during the release packaging process.
The attack mechanism involved three files installed in the site-packages directory. One file, cook.pth, imports a Python script that collects SSH keys, cloud credentials, CI/CD secrets, and AI provider tokens. This data is encrypted and sent to a remote server. A second file, sitecustomize.py, launches a background daemon that runs hourly, reading a server address from a GitHub file and downloading new code for execution. This allows attackers to update the malware without re-releasing the package.
PyPI quarantined the trojanized version within hours, and the corresponding Docker image was removed from Docker Hub and GitHub Container Registry. Security analysts from Aikido, Wiz, and Socket have published mitigation guides, advising users to check for specific temporary files to determine if the malware executed. The most recent safe version is identified as v1.106.2. This incident follows an earlier LiteLLM compromise in March, which potentially exposed thousands of organizations, highlighting ongoing risks in the AI infrastructure supply chain.
Sources
The WireByte editorial team synthesises technology news from multiple primary sources, verifies the facts, and links every source. Articles are produced with AI assistance and reviewed under our editorial policy.
