LiteLLM 1.107.0 wheels carried a credential stealer and remote-code loader
Security researchers found that all seven PyPI wheels for LiteLLM 1.107.0 installed three files that run when Python starts, even if an application never imports LiteLLM. The payload targeted developer, cloud and AI-tool credentials; affected Docker images also reached public registries. PyPI removed the release, and LiteLLM’s maintainers removed the malicious images, but researchers say the route used to publish the release remains under investigation.
Bottom line — LiteLLM 1.106.2 was identified as a clean version; replacing the package alone does not remove files already installed.
Go deeper 5
-
SafeDep found an added `data = "cook"` build setting absent from the release’s Git tag; the source archive lacked the three payload files.
-
Socket traced container-build provenance to a lookalike repository, Berri-AI/litellm, but said this does not establish how the source override was authorised.
-
The stealer targeted browser data, SSH keys, cloud credentials, AI coding-tool tokens and, on configured proxy deployments, stored provider API keys.
-
Researchers found that the remote loader checked a GitHub-hosted pointer hourly; reports said it was empty or offline during analysis.
-
The earlier LiteLLM compromise involved versions 1.82.7 and 1.82.8. JFrog said there was no evidence linking the incidents.