Attackers hijack LiteLLM release pipeline to distribute credential-stealing malware

Attackers breached the release process for LiteLLM on Wednesday, distributing a tainted release, version 1.107.0, across PyPI and Docker registries. The open-source AI gateway, maintained by BerriAI, receives around 23 million weekly downloads. PyPI quarantined the package within hours, and the malicious Docker image was pulled from Docker Hub and GHCR, leaving version 1.106.2 as the most recent safe release. [1][2]

The intruders pushed malicious files by using compromised GitHub CLI OAuth tokens and commits on a spoofed repository, according to SecurityWeek and researchers at Wiz. The payload quietly executes alongside Python to steal cloud credentials from AWS, Google Cloud, and Microsoft Azure, as well as API keys for services like OpenAI and Anthropic. It also installs a remote access trojan that polls attacker infrastructure hourly to run arbitrary commands. [1][2]

Security firms including Aikido, Socket, and Wiz warn that any organization that deployed version 1.107.0 or pulled the latest Docker tags must assume their credentials were stolen. LiteLLM suffered an earlier compromise in March that exposed thousands of organizations, according to CloudSEK, highlighting ongoing risks for development teams integrating centralized AI gateways. [2]