AI BriefingLiteLLM v1.107.0 Supply Chain Attack, Estimated ~49,000 Downloads
·2026.10.23 13:30
Key point
Malicious LiteLLM v1.107.0 was distributed through a manipulated official pipeline, posing a risk of credential theft.
Details
- A supply chain attack occurred where credential theft code was included in LiteLLM v1.107.0 and distributed via PyPI and Docker
- Wiz estimates the number of downloads of the malicious version at approximately 49,000, with PyPI exposure lasting from 11:39:51 to 13:23
- It collected browser passwords, SSH keys, cloud credentials, and LLM API keys within the LiteLLM proxy DB and exfiltrated them externally
- A remote code execution (RCE) backdoor was activated in Linux/macOS environments, enabling the execution of additional malicious code
- The attacker stole GitHub CLI credentials to manipulate the release workflow and built from a similar repository (Berri-AI/litellm)
- Cosign signatures passed verification because the manipulated workflow signed them, and it was detectable because the source repository URL was recorded in the SLSA provenance
- Immediately pin to version 1.106.2 and delete the cook.pth, cook.py, sitecustomize.py files and related processes
- LiteLLM proxy environments exposed to the internet should check logs for potential token leakage and unknown user accounts
This summary was generated automatically by AI. Check the original for the author's claims and context. Copyright belongs to the original author.
Our guide explains how the AI works. Report summary errors, attribution issues, or removal requests via Contact.
Related
LiteLLM 1.107.0 PyPI Compromise Installs Credential Stealer and Backdoor
LiteLLM v1.107.0 Compromised with Malware Stealing Credentials and Enabling Remote Code ExecutionNvidia OpenShell: Secure Runtime for Autonomous AI Agent Fleets
AWS Continuum for code vulnerabilities reaches general availability