LiteLLM Compromised in Fresh Supply Chain Attack
LiteLLM supply chain attack serves malware via compromised PyPI and Docker packages.
Run Berri-AI?
Get an email when a reviewed story names Berri-AI, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
LiteLLM, a popular open-source LLM proxy, was compromised in a supply chain attack on October 21st. Attackers used leaked GitHub CLI OAuth tokens to push malicious version 1.107.0 to PyPI and Docker, which was downloaded over 49,000 times before being removed. The malware acts as an information stealer and RAT, targeting cloud secrets, API keys, and credentials.
The lesson from this incident
Full lessonAttackers leveraged leaked GitHub CLI OAuth tokens to gain unauthorized access to LiteLLM's publishing pipeline, injecting malicious code into version 1.107.0 before it was distributed via PyPI and Docker. This attack highlights how a single compromised credential in a CI/CD or development toolchain can cascade into a wide-scale supply chain compromise, affecting over 49,000 downloads. The malware functioned as both an information stealer and a Remote Access Trojan (RAT), specifically targeting cloud secrets and API keys — high-value assets in AI/LLM-driven environments. This incident underscores that open-source ecosystems are high-value targets, and that token hygiene and pipeline integrity controls are no longer optional.
What helps against this
How we list vendors- Secrets management
API keys, tokens and passwords stop leaking from code, chat and configuration files.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Software supply chain security
Malicious and vulnerable open-source packages are caught before they ship.