Open-source AI gateway LiteLLM has contained a supply chain attack after attackers pushed a malicious version of the software to the PyPI and Docker registries on Wednesday.
LiteLLM is a Python-based tool that supports more than 140 large language model providers. It is estimated to have 23 million weekly downloads.
The malicious v1.107.0 version, which was available for nearly three hours across PyPI and Docker, contained credential-stealing malware and loaded remote-code-execution tools, LiteLLM said.
“All previous versions are safe, and the impacted releases have been pulled. Enterprise customers running the private enterprise release of LiteLLM were not impacted,” the company said.
The malicious PyPI package litellm==1.107.0 that was distributed through PyPI was available for around two hours, between 11:39 UTC to 13:23 UTC, on Wednesday.
It affected all seven wheels, or pre-built Python software packages published for that version. On Docker Hub, four tags, including “latest,” pointed to the same compromised image index, and four GitHub Container Registry tags were also affected.
Any user who installed the affected version through Python package installer pip during its exposure window, or ran the affected Docker image, is at risk of compromise, LiteLLM said.
The attackers obtained GitHub CLI OAuth tokens, which they used to override branch protections and run a release workflow pointed at a lookalike repository, “Berri-AI/litellm.” The initial access method is still unconfirmed.
Socket Security, which analyzed the malicious package, said the files collected cloud credentials, private keys, browser data and authentication files for AI development tools. These included auth and config files for Claude, Codex, Copilot, Cursor and Gemini, as well as Kubernetes, Vault and Terraform secrets.
“Teams using 1.107.0 should stop deploying it and investigate environments where Python ran after installation, including proxy containers and CI runners,” Socket Security said. LiteLLM advised users to pin to version 1.106.2, assume credentials were exfiltrated if 1.107.0 ran on a host with outbound internet access, and rotate any credentials the host could reach, including provider keys stored in the proxy database.
LiteLLM removed the malicious package and affected Docker images, repointed its Docker tags to clean builds, and restricted maintainer credentials while it investigates.
