{
  "id": 15928701,
  "title": "LiteLLM supply chain attack hoovers up passwords and secrets",
  "url": "https://urgent.news/2026/10/21/litellm-supply-chain-attack-hoovers-up-passwords-and-secrets",
  "topic": "science",
  "section": "Science",
  "published": "2026-10-21T18:22:20.000Z",
  "source": {
    "name": "The Register Science",
    "slug": "the-register-science",
    "url": "https://www.theregister.com/security/2026/10/21/litellm-supply-chain-attack-hoovers-up-passwords-and-secrets/5304548"
  },
  "original_language": "en",
  "account": "Unknown assailants upended LiteLLM's distribution process on Wednesday, releasing a tainted version (1.107.0) packed with malware aimed at pilfering cloud and AI account details and a remote access trojan (RAT) that enables arbitrary code execution on compromised systems via PyPI and Docker repositories. PyPI isolated the tainted version of the widely-used open-source AI gateway within hours, and the Docker image (litellm/litellm:1.107.0) was deleted from Docker Hub and GHCR shortly after. However, any user who executed the infected package on any platform should presume their secrets were stolen. \"Inspect for /tmp/.pc_once_* (exfiltration has already transpired if this file exists) and /tmp/remote_code_loader.lock (C2 daemon initiated or persists if this file exists),\" cautioned Aikido Security malware analyst Ilyas Makari. \"The same applies to anyone who executed the official Docker image litellm/litellm:1.107.0, or downloaded it via the latest, main-latest, or main-stable tags.\" It is too early to determine the extent of this latest LiteLLM supply chain intrusion - a March LiteLLM breach might have compromised over 2,500 organizations and 434,000 CI/CD pipelines globally, as per CloudSEK - but take these precautions seriously and scrutinize environments for any signs of compromise. Aikido, Google's Wiz cloud security firm, and supply-chain security firm Socket have issued comprehensive threat-hunting and mitigation guidelines for LiteLLM users and security teams; read them immediately. LiteLLM, crafted by BerriAI, serves as a universal interface for LLM providers, such as OpenAI, Anthropic, and Google Gemini, and has garnered approximately 23 million weekly downloads. This implies that a compromised installation can operate in tandem with LLM provider API keys, cloud identities, and database connection strings, thereby exposing a wealth of valuable credentials, secrets, and other sensitive information to the party who uploaded the malicious package. \"Teams employing 1.107.0 should cease deploying it and scrutinize environments where Python executed post-installation, including proxy containers and CI runners,\" remarked Socket researchers Benjamin Read and Rami McCarthy on Wednesday. The malicious version was uploaded at 11:39 UTC, and per Wiz analysts, the payload stems from malicious commits in github.com/Berri-AI/litellm, a hyphenated iteration of the legitimate BerriAI organization. Per Makari, these comprise cook.pth, which triggers the second file, cook.py, to execute automatically each time Python is invoked on the machine, sans any user intervention. Moreover, cook.py harbors the data thief, and sitecustomize.py is the RAT. Upon execution, Python carries out the RAT and spawns a background daemon that periodically polls the attacker's infrastructure hourly for fresh commands to execute. Upon activation, the data thief harvests vast quantities of sensitive data across 16 modules targeting browsers (Chrome, Firefox, Edge, Safari), cloud providers (AWS, GCP, Azure), and AI services. It acquires browser credentials and cookies, AWS credentials from ~/.aws/, environment variables, and EC2/ECS instance metadata (IMDS). Additionally, it obtains Google Cloud Platform service account keys and application default credentials, Microsoft Azure tokens from the CLI cache, and SSH private keys, GPG keys, and shell history files. Upon exfiltration, the data is encrypted using AES-256-CBC, the encryption key is wrapped with an RSA-4096 public key, and the encrypted data is transmitted via HTTP POST to an attacker-managed domain: http://www.litellm.dev/healthcheck. BerriAI declined to comment on The Register's request for comment. This is a developing tale, and we will continue to update it as additional details emerge.",
  "summary": "Plus a RAT for good measure - get threat hunting now",
  "key_points": [
    "Malicious version 1.107.0 of LiteLLM released, packed with malware and RAT",
    "PyPI isolated tainted version within hours, Docker image deleted from Docker Hub and GHCR",
    "Users who executed infected package should presume secrets were stolen"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 2,
    "also_reported_by": [
      {
        "outlet": "The Register",
        "title": "LiteLLM supply chain attack hoovers up passwords and secrets",
        "url": "https://urgent.news/2026/10/21/litellm-supply-chain-attack-hoovers-up-passwords-and-secrets-15929362",
        "published": "2026-10-21T18:22:20.000Z"
      }
    ]
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}