LiteLLM packages on PyPI and Docker Hub compromised to steal credentials

Security firm Wiz found that a malicious version of the popular LiteLLM package (1.107.0) was uploaded to PyPI on October 21 and quarantined about 100 minutes later; matching trojanized Docker images on GHCR and Docker Hub were removed roughly 15 minutes after that. LiteLLM's developer, BerriAI, said the attacker used stolen GitHub CLI OAuth tokens tied to three engineers' accounts to trigger and approve a malicious release.

Once installed, the package dropped files that run automatically whenever Python starts, deobfuscating a credential-stealing routine that harvests browser credentials, AWS, GCP, and Azure cloud credentials, SSH and GPG keys, shell history, and API keys for AI providers including OpenAI and Anthropic. Where LiteLLM's proxy stores other companies' upstream API keys in a database, the malware queried that database directly to pull them out. Stolen data was encrypted and sent to a lookalike domain impersonating LiteLLM's real site.

BerriAI said it believes the attacker first got into its internal LiteLLM deployment, which was exposed to the public internet, and pulled GitHub tokens from logs there, tokens that had ended up in those logs partly because Claude Code had embedded a user's GitHub CLI OAuth token into a logged response. Wiz observed attackers using stolen cloud credentials within hours to probe AWS accounts and list AI models, consistent with reselling stolen AI access.

Why it matters

A popular LLM infrastructure package was weaponized to steal cloud and AI credentials at scale, a serious supply-chain risk for anyone running LiteLLM.

Source: Wiz