On October 21, 2026, the malicious LiteLLM v1.107.0 package was available on PyPI for about two hours, and the Docker latest tag pointed to a malicious image for three hours. It automatically ran a backdoor at Python startup and specifically stole a full set of AI and cloud service credentials for OpenAI, Anthropic, AWS, Azure, GCP, HuggingFace, and others.
Factual Reconstruction
The attackers used stolen GitHub OAuth tokens from three LiteLLM maintainers to modify the release process and trigger the push of the malicious version. The malicious PyPI package was available from 11:39 to 13:23 UTC, and malicious images under the Docker v1.107.0, latest, main-latest, and main-stable tags were served from 11:46 to 14:20 UTC. All previous versions were safe, the affected versions have been removed, and the latest safe version is v1.106.2.
According to reports, the attackers found an unexpected user account in an internal LiteLLM deployment exposed to the public internet and obtained tokens through its logs. The malicious code was implanted in the Python startup file and would execute regardless of whether the application loaded LiteLLM. It collected AWS, Azure, Google Cloud, Kubernetes, and Docker credentials, as well as Git, SSH, and GPG keys, browser login information, and model settings from LiteLLM proxy deployment databases.
Mechanism Breakdown
The malicious code encrypted the collected data and sent it to a healthcheck address under the litellm[.]dev domain, and periodically checked a GitHub file for follow-on remote code execution instructions. Socket analysis showed that this version contained malicious components in seven builds across macOS, Linux, and Windows. Build records showed that the source repository was named Berri-AI/litellm, one character different from the legitimate BerriAI/litellm project.
Wiz researchers observed that about 4.5 hours after data left victim systems, the attackers began validating AWS credentials obtained from CI runners and Kubernetes nodes and checking whether they could access AI models on Amazon Bedrock.
Industry Impact
As a key middleware layer for enterprise AI agent deployments, LiteLLM connects multiple model providers and cloud services. The second supply chain intrusion this year directly affects the security of enterprise deployments using this toolchain. Enterprise customers that installed v1.107.0 must treat credentials as compromised and rotate them. Customers using private registries were unaffected.
The attack exposed the structural risk of targeted hunting of AI infrastructure maintainer accounts. The collected credentials included authentication files for Codex, Claude, Gemini, and Cursor, showing the attackers' systematic interest in AI development environments.
Strategic Judgment
(This paragraph is analysis, not fact.) Both LiteLLM incidents intruded into the release pipeline through maintainer accounts, indicating that the middleware layer of AI toolchains has become a high-value target. Enterprises need to reassess their dependence on a single open-source proxy tool, especially when that tool handles multi-cloud and multi-model credentials. Historical supply chain attacks show that a short time window can still lead to long-term credential abuse; prioritizing multi-factor authentication and release process isolation is recommended.
© 2026 Winzheng.com 赢政天下 | 转载请注明来源并附原文链接