Skip to content

LiteLLM's PyPI release shipped a credential stealer for two hours

A compromised 1.107.0 build of the open-source LLM gateway stole cloud and AI credentials before PyPI and Docker Hub could pull it.

Source: StepSecurity

LiteLLM 1.107.0, a release of the widely used open-source LLM gateway, was compromised with a credential stealer and a remote code loader before being pulled from PyPI and Docker Hub on 21 October.

The attacker built the release from a lookalike repository, Berri-AI/litellm with a hyphen, not the real BerriAI/litellm, then triggered the project’s own release workflow. A data = "cook" line added to the build config told the build tool to bundle a hidden directory into every wheel. On install, the payload ran at Python startup and collected SSH keys, cloud credentials for AWS, Azure and GCP, Kubernetes tokens, browser-saved passwords, AI tool tokens, and anyone’s LiteLLM proxy database, encrypting the haul and sending it out over HTTP. A second file polled a GitHub repo once an hour for further commands. The wheels went up at 11:39 UTC; PyPI removed the release by 13:23 UTC, with the infected Docker tags following roughly an hour later. LiteLLM gets about 23 million downloads a week.

Why it matters: if you installed or ran litellm==1.107.0 in that window, the fix is not just reinstalling. Every credential reachable from that machine should be treated as leaked and rotated, and cook.pth, cook.py and sitecustomize.py need removing from site-packages by hand.

The caveat: pin to litellm==1.106.2, the last version confirmed clean, rather than trusting latest again straight away.

Share

Related reading

Engineering

How to patch PHP in a hurry without breaking production

PHP ships an out-of-band fix for two critical flaws at 14:00 UTC today. Here is the hour of preparation that turns the patch into a non-event, and the runbook for when it lands.

ML for Web Devs

Tokens, context windows, and why your bill is what it is

The unit of billing for language models is not the request or the word. Once you understand tokens and how a context window fills up, the invoice stops being a surprise.

ML for Web Devs

RAG is just search with extra steps

Retrieval-augmented generation gets written up like an architecture. It is a search query, a string concatenation and one API call, and the search query is the part that decides whether it works.

More from The Wire

All briefs

Next.js 15 reaches end of life today

Two years after its release, Next.js 15 stops receiving even critical bug fixes and security updates. Vercel recommends moving to 16, which is in Active LTS.

via Next.js