Poisoned LiteLLM 1.107.0 shipped a credential stealer to PyPI and Docker for under three hours
LiteLLM said on October 21 that attackers published a malicious litellm 1.107.0 to PyPI, Docker Hub and GHCR, built from a lookalike Berri-AI/litellm repository. The package stole credentials and installed a backdoor; Wiz saw stolen AWS role credentials tested hours later.
LiteLLM disclosed on October 21 that attackers had compromised its release workflow and published litellm==1.107.0, an AI gateway package, containing a credential stealer and a backdoor. The seven PyPI wheels were live from 11:39 to 13:23 UTC, and the v1.107.0, latest, main-latest and main-stable tags on Docker Hub pointed to a compromised image from 11:46 to 14:20 UTC; GHCR tags were affected until 13:51 UTC. The artifacts were built from a lookalike repository, Berri-AI/litellm, so the official source tag is clean. The Hacker News, citing Wiz, reported that a cook.pth file collected cloud, browser, developer and AI tool secrets, and that about 4.5 hours later the attacker tested AWS instance role credentials from compromised CI runners and Kubernetes nodes, then queried Bedrock. Enterprise customers on LiteLLM's private registry were not affected.
Why it matters
An AI gateway holds every provider key an organization uses, plus its cloud role, so a poisoned gateway release is a bulk theft of non-human identities. The first thing the attacker did with the loot was call sts:GetCallerIdentity, which is a cheap signal you can alert on.
If 1.107.0 ran anywhere with outbound internet, LiteLLM says to assume exfiltration. Do not run pip first: remove cook.pth, cook.py and sitecustomize.py from site-packages, kill the daemon holding /tmp/remote_code_loader.lock, rebuild images, and pin to 1.106.2. Then rotate the instance role, every provider key in the proxy database, master and virtual keys and the database password, following a secrets rotation runbook. Pin images by digest, not tag. LiteLLM gateways were also in our September post on the example admin key.
Source: LiteLLM
Related on Start with Identity
- BlogLiteLLM traces its poisoned release to an admin key leaked in May and never revoked
LiteLLM's October 23 attack-chain report says an Agent Platform admin key committed to a public repo on May 27 was deleted but never revoked. On October 10 it r
- BlogInfisical raises a $40 million Series B to build secrets and credential access for AI agents
Infisical announced a $40 million Series B on October 27 at a $600 million valuation, led by Elad Gil. The open-source secrets company says it will invest in se
- BlogMicrosoft names Storm-0940 behind ConnectWise app abuse that reached 2,250 Microsoft 365 tenants
Microsoft said on October 21 that China-aligned Storm-0940 used the ARTEX agentic AI framework and stolen ConnectWise application identities to try signing in t
- RankingBest Verifiable Credential Platforms: Issuance & Verification Infrastructure
The best verifiable credential platforms in 2026: MATTR, Procivis, SpruceID, walt.id, and Hyperledger. Ranked for standards conformance (W3C VC, SD-JWT, OpenID4
- CVEBeyondTrust Remote Support zero-day, from file upload to the whole credential vault
An origin-validation flaw in self-hosted BeyondTrust Remote Support through 26.2.3 let ARMORY CASTLE plant a web shell, export every vaulted admin credential, a
- TechniqueCredential manager key extraction
A passkey or Windows Hello key is supposed to stay locked to its device. Code running on an already-compromised endpoint can pull the key material out of the pr