LiteLLM, a popular open source proxy for AI model routing, was compromised on October 21 when attackers hijacked its release pipeline and published a poisoned version 1.107.0. The packages were live for about three hours across PyPI and Docker Hub, long enough for an estimated 49 000 downloads. The GitHub source tag was clean — the artifacts came from a lookalike repository.
Attackers held GitHub CLI OAuth tokens for three developer accounts. LiteLLM says one set likely leaked through Claude Code, which in specific circumstances embeds tokens into a response body that may be logged — and the internal deployment holding those logs was exposed to the public internet. How the attackers reached that deployment, or moved laterally once inside, remains unclear. They used the tokens to disable branch protections, redirect the release pipeline, and publish signed packages.
The payload drops three files into the site-packages root and runs whenever a Python interpreter starts, with no import of litellm needed. It harvests browser credentials, AWS, GCP, and Azure secrets, SSH keys, and AI API keys from Anthropic, OpenAI, and GitHub Copilot, encrypting them to litellm[.]dev — a lookalike domain registered eight days earlier. A second component fetches fresh code hourly.
Wiz saw attackers querying Amazon Bedrock with stolen AWS credentials about 4.5 hours after exfiltration, which it reads as LLMjacking. Enterprise customers on LiteLLM’s private repository were unaffected. Anyone who installed 1.107.0, including through the Docker latest, main-latest, or main-stable tags, should remove it, rotate every credential on the machine, and scan for malware. The latest clean version is 1.106.2.
Source: SecurityWeek
