LiteLLM PyPI Package and Docker Images Compromised to Steal Cloud and AI Credentials
LiteLLM 1.107.0 PyPI package and Docker images compromised with credential stealer via Python startup hooks.
Run Socket (AI scanner)?
Get an email when a reviewed story names Socket (AI scanner), usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
LiteLLM version 1.107.0 was compromised in a supply chain attack distributing malicious Python wheels and container images designed to steal cloud credentials, API keys, and developer secrets. The attack leveraged a lookalike GitHub repository (Berri-AI/litellm instead of BerriAI/litellm) in the project's release workflow, with malware activated through Python startup hooks that execute without explicit LiteLLM imports. Socket's AI scanner detected the compromise within seven minutes of PyPI publication across seven affected wheel distributions and container images.
The lesson from this incident
Full lessonAttackers compromised LiteLLM version 1.107.0 by injecting malicious code through a lookalike GitHub repository (Berri-AI vs. BerriAI), exploiting insufficient verification in the project's release workflow. The malware used Python startup hooks to execute silently — without any explicit LiteLLM import — making it exceptionally stealthy and difficult for developers to detect manually. This attack demonstrates how a single weak link in a CI/CD pipeline can expose cloud credentials, API keys, and developer secrets at scale across all downstream users. The incident underscores why automated integrity verification and provenance checks for open-source packages are no longer optional for teams handling sensitive infrastructure.
What helps against this
How we list vendors
- Secrets management
API keys, tokens and passwords stop leaking from code, chat and configuration files.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Software supply chain security
Malicious and vulnerable open-source packages are caught before they ship.
Indicators of Compromise
- url — https://github.com/Berri-AI/litellm