Attacker used LiteLLM’s release pipeline to ship a credential stealer
- Affected
- LiteLLM
1.107.0from PyPI, and LiteLLM’s Docker images taggedv1.107.0,latest,main-latestormain-stableon Oct 21. All versions and fixes
- Vendor
- LiteLLM
An attacker used LiteLLM’s release workflow to publish version 1.107.0 to PyPI, Docker Hub and GitHub’s container registry on Oct 21 with a credential stealer inside, LiteLLM and Wiz say. The stealer runs whenever Python starts and takes cloud, browser, SSH and AI service secrets, including provider keys stored in the LiteLLM proxy’s database. LiteLLM pulled the release within hours and says to pin 1.106.2. Wiz saw AWS credentials taken by the stealer being tested about 4.5 hours after they were sent.
LiteLLM says the attacker held GitHub CLI credentials for three of its developers. It believes they came from the logs of an internal LiteLLM deployment that was exposed to the internet, where it found an unexpected user account with a harmless-looking name. LiteLLM says that in specific situations Claude Code puts a user’s GitHub CLI token in a response body, where logging may capture it. It hasn’t confirmed how the attacker got into the deployment, but suspects “a recently patched vulnerability.”
One token belonged to a GitHub organization owner, which let the attacker turn off branch protections and force-push a change to the release workflow, LiteLLM says. The changed workflow built the release from a lookalike repository, Berri-AI/litellm, then signed and published it. A second developer’s credential passed the production approval gate, and a third deleted the workflow records. The official 1.107.0 source tag doesn’t contain the malicious files.
Wiz says the package drops , cook.py and sitecustomize.py into site-packages, so the stealer runs each time Python starts. It encrypts what it gathers and sends it to , a lookalike domain the attacker controls. The loader also checks a GitHub dead drop for a second stage, which Wiz says never held more than test values. Wiz says the code shows strong signs that an LLM helped write it.
LiteLLM says anyone who installed an unpinned LiteLLM with pip from 7:39 to 9:23 a.m. ET is affected. So is anyone who ran the v1.107.0, latest, main-latest or main-stable images from 7:46 to 10:20 a.m. ET. Customers on its private enterprise registry weren’t. From 12:20 to 1:01 p.m. ET, Wiz saw the attacker test AWS instance role credentials taken from CI runners and Kubernetes nodes. The attacker then listed Bedrock models, which Wiz calls consistent with LLMjacking.
- Vendor
- LiteLLM
What to do
8 steps
- 2 Search affected hosts for litellm-1.107.0.dist-info, cook.pth and sitecustomize.py, though LiteLLM says not finding them doesn’t prove a host is clean.
- 3 Delete cook.pth, cook.py, sitecustomize.py and their cached .pyc files from the shell before running pip, since LiteLLM says any Python start reruns the malware.
- 4 Kill the detached Python process that holds /tmp/remote_code_loader.lock, as LiteLLM advises.
Affected and fixed versions
| Product | Affected | Fixed |
|---|---|---|
| LiteLLM on PyPI | 1.107.0, from 7:39 to 9:23 a.m. ET on Oct 21 | 1.106.2, or any earlier version pinned explicitly |
| LiteLLM images on Docker Hub | v1.107.0, latest, main-latest and main-stable, from 7:46 to 10:20 a.m. ET on Oct 21 | Tags removed or pointed at clean images |
| LiteLLM images on GitHub Container Registry | Same tags, from 7:46 a.m. ET until they were unavailable by 9:51 a.m. ET | Tags made unavailable |
| LiteLLM private enterprise release | Not affected, LiteLLM says | No action needed |
- Product
- LiteLLM on PyPI
- Affected
1.107.0, from 7:39 to 9:23 a.m. ET on Oct 21- Fixed
1.106.2, or any earlier version pinned explicitly
- Product
- LiteLLM images on Docker Hub
- Affected
v1.107.0,latest,main-latestandmain-stable, from 7:46 to 10:20 a.m. ET on Oct 21- Fixed
- Tags removed or pointed at clean images
- Product
- LiteLLM images on GitHub Container Registry
- Affected
- Same tags, from 7:46 a.m. ET until they were unavailable by 9:51 a.m. ET
- Fixed
- Tags made unavailable
- Product
- LiteLLM private enterprise release
- Affected
- Not affected, LiteLLM says
- Fixed
- No action needed
Indicators
Domains, URLs and IPs copy defanged. Use Copy raw for queries.
| Type | Value | Note |
|---|---|---|
| Domain | Attacker-controlled lookalike domain used for exfiltration, per Wiz | |
| URL | Endpoint the stealer sends encrypted data to, per Wiz | |
| IP address | Tested stolen AWS credentials, per Wiz | |
| IP address | Tested stolen AWS credentials, per Wiz | |
| File name | Persistence hook in site-packages that loads the stealer | |
| File name | Run-once marker, which LiteLLM says confirms exfiltration | |
| File name | Lock file held by the malware’s detached Python process, per LiteLLM | |
| SHA-256 | cook.pth for Linux and macOS, per Wiz | |
| SHA-256 | cook.pth for Windows, per Wiz | |
| SHA-256 | cook.py credential stealer for Linux and macOS, per Wiz | |
| SHA-256 | cook.py credential stealer for Windows, per Wiz | |
| SHA-256 | sitecustomize.py loader for Linux and macOS, per Wiz | |
| SHA-256 | sitecustomize.py loader for Windows, per Wiz | |
| SHA-256 | Compromised Docker image index digest, per LiteLLM |
- DomainAttacker-controlled lookalike domain used for exfiltration, per Wiz
- URLEndpoint the stealer sends encrypted data to, per Wiz
- IP addressTested stolen AWS credentials, per Wiz
- IP addressTested stolen AWS credentials, per Wiz
- File namePersistence hook in site-packages that loads the stealer
- File nameRun-once marker, which LiteLLM says confirms exfiltration
- File nameLock file held by the malware’s detached Python process, per LiteLLM
- SHA-256cook.pth for Linux and macOS, per Wiz
- SHA-256cook.pth for Windows, per Wiz
- SHA-256cook.py credential stealer for Linux and macOS, per Wiz
- SHA-256cook.py credential stealer for Windows, per Wiz
- SHA-256sitecustomize.py loader for Linux and macOS, per Wiz
- SHA-256sitecustomize.py loader for Windows, per Wiz
- SHA-256Compromised Docker image index digest, per LiteLLM
Timeline
- Oct 21The attacker pushes 10 commits with the payload to a lookalike repository, Wiz says.
- Oct 21A developer’s credential overrides branch protection on LiteLLM’s private release workflow.
- Oct 21Seven malicious
1.107.0wheels reach PyPI, and the Docker images follow minutes later. - Oct 21PyPI removes
1.107.0, and LiteLLM removes or repoints the Docker tags by 10:20 a.m. ET. - Oct 21Wiz sees the attacker test stolen AWS credentials from 12:20 p.m. ET.