Attackers compromised the release process of LiteLLM, the open-source AI gateway, on Wednesday and pushed a malicious version 1.107.0 to PyPI and Docker registries. The package contained an infostealer and a remote access trojan. PyPI quarantined the package within hours, and Docker Hub and GHCR removed the image, but anyone who ran it should assume their credentials are compromised.
The malicious code came from commits on a lookalike GitHub repo, Berri-AI/litellm, and was injected into the release pipeline via three files. A .pth file triggers a Python script at interpreter startup, which runs the infostealer; a separate sitecustomize.py spawns a daemon that polls attacker infrastructure hourly. The infostealer targets browser credentials, AWS, GCP, Azure, LLM provider API keys, SSH/GPG keys, and shell history, then exfiltrates the data encrypted to an attacker-controlled domain.
Security firms Aikido, Wiz, and Socket have published threat-hunting guidance. Indicators include /tmp/.pc_once_* and /tmp/remote_code_loader.lock. LiteLLM sees about 23 million weekly downloads, and a previous compromise in March may have exposed over 2,500 organizations and 434,000 CI/CD pipelines, according to CloudSEK. BerriAI did not respond to requests for comment.