The Pulse
LiteLLM Says Compromised 1.107.0 Release Stole Credentials
LiteLLM says a compromised release of its AI gateway exposed users who installed version 1.107.0 or ran affected container images to credential theft. The company traced the attack to stolen developer credentials used to alter its release w
AI.info Team · Written with AI · fact-checked ·
LiteLLM’s release pipeline published a malicious version of its AI gateway on October 21, putting cloud, developer and AI-service credentials at risk for users who installed the package or ran affected containers. The company says the compromised release, version 1.107.0, appeared on PyPI for about two hours and in Docker images for roughly two and a half hours before the affected artifacts were removed.
The exposure included PyPI’s seven 1.107.0 wheels and Docker Hub and GitHub Container Registry images labeled v1.107.0, latest, main-latest and main-stable. LiteLLM says its private enterprise release was not affected and that earlier versions are safe. In an October 22 update on the project’s GitHub issue, the company said its investigation continued and regular releases remained paused.
Three developer credentials reached the release workflow
LiteLLM’s account of the attack describes stolen GitHub CLI credentials associated with three developer accounts. The attackers used them to override branch protections, change the private release workflow and direct a build at a lookalike repository, Berri-AI/litellm, rather than the project’s BerriAI/litellm repository. The official v1.107.0 source tag did not contain the malicious files.
The attacker had to compromise multiple independent security controls to be successful.
LiteLLM’s incident report, jointly authored by Krrish Dholakia (CEO), Ishaan Jaffer (CTO), Oliver Jensen (director of security) and Nate Armstrong (lead Rust engineer)
According to the company’s timeline, an unauthorized workflow change bypassed branch protections at 10:08 UTC on October 21. A staging build used the lookalike repository before the production pipeline began; a second developer credential satisfied the production approval gate. A third account was then used to delete production and staging workflow records, limiting the logs available for the investigation.
LiteLLM says it believes an attacker accessed an internal deployment exposed to the public internet and retrieved GitHub CLI OAuth tokens from its logs. The company says it has observed situations where Claude Code places a user’s GitHub CLI token in a response body, which could expose the token if that response is logged. It has not confirmed how the attacker first accessed the deployment, and says a recently patched vulnerability is one possibility under investigation.
Python ran the payload without importing LiteLLM
Security researchers at Datadog Security Labs found three added files in Python’s site-packages directory: cook.pth, cook.py and sitecustomize.py. Because Python processes these startup files when an interpreter launches, the credential stealer could run even if an application never imported LiteLLM. The files could also run again when users invoked Python or pip in the affected environment.
The malware sought cloud credentials, SSH and Git secrets, browser passwords, AI-provider API keys and credentials for coding tools including Claude, Codex, Gemini, Cursor and Copilot. On a LiteLLM proxy configured with a database, it could also query tables holding stored provider keys. A separate component checked a GitHub-hosted file for instructions and was built to fetch and execute remote Python code; Datadog said the file held only test values and that it had not observed a second-stage payload.
LiteLLM tells exposed users to treat secrets as stolen
The company advises users who installed v1.107.0 or ran an affected image during the exposure window to treat the environment as compromised. It says to remove the startup files before launching Python again, rebuild from a clean environment using version 1.106.2, and rotate every credential the affected host could access, including provider keys, cloud roles and database passwords. LiteLLM warns that the absence of a marker file does not prove the system is clean.
By 14:20 UTC on October 21, the company says affected Docker Hub tags and image variants had been removed or redirected to verified clean artifacts; PyPI had removed v1.107.0 by 13:23 UTC. In its October 22 update on the project’s incident issue, LiteLLM reported no material developments since its previous update and said its registries remained locked to new releases. The company said it was moving from scheduled two-hour updates to posting when significant developments were available.