LiteLLM, a widely used open-source AI gateway, was hit by a supply chain attack that distributed version 1.107.0 through PyPI and Docker images. Security firms SafeDep, Socket, StepSecurity, and Upwind reported the compromise, and the package has since been quarantined on PyPI while the malicious Docker images were removed.
LiteLLM security director Oliver Jensen said the attack was carried out using stolen GitHub CLI OAuth tokens tied to three engineers' accounts. One account triggered the release workflow and another approved it, but the mechanism behind the token theft is still unknown. All involved tokens have been revoked, and LiteLLM temporarily removed all but one unaffected user from its GitHub organization as a precaution.
Analysts found the malicious code executes before LiteLLM is even imported, using a path file that loads a payload called privcollect. It harvests cloud credentials, private keys, browser data, AI tooling authentication files, and LiteLLM proxy credentials, then exfiltrates them in a compressed archive. A second payload forks a background daemon that checks a GitHub dead drop hourly and runs whatever code the attacker serves.
Affected artifacts include multiple platform-specific wheels and the source tarball for 1.107.0. Users who downloaded the malicious version should revoke and replace exposed credentials from a clean environment and pin LiteLLM 1.106.2 by digest.