LiteLLM 1.107.0 Compromised to Steal Cloud, AI Tool and Developer Credentials
Do Son 
| At a glance | |
| Malware family | “privcollect” credential stealer plus a remote Python loader |
| Threat actor | Unknown; no attribution |
| Targets | Users of LiteLLM 1.107.0 on PyPI and its container images (about 23M weekly downloads, per Socket) |
| Delivery vector | Malicious release built from a lookalike source repository |
| Key capabilities | Steals cloud, AI tool, SSH, and browser secrets; runs remote Python code |
| Source | Socket Threat Research, with findings from Upwind |
TL;DR
On October 21, 2026, a malicious LiteLLM 1.107.0 release reached PyPI and GitHub’s container registry. The LiteLLM supply chain attack plants a credential stealer that runs whenever Python starts, even if LiteLLM is never imported. Socket says the build pulled code from a lookalike repository whose name differs by a single hyphen.
Delivery
LiteLLM is a popular proxy and common interface for large language model providers. As a result, it often runs next to API keys, cloud identities, and database passwords.
Socket’s AI scanner flagged all seven 1.107.0 wheels about seven minutes after publication. Separately, Upwind found the same payload in a published LiteLLM container image.
A one-hyphen lookalike
The build records explain how the LiteLLM supply chain attack worked. The image’s provenance shows that the release workflow pulled source from “Berri-AI/litellm” instead of the real “BerriAI/litellm.” By contrast, the previous version, 1.106.2, recorded the legitimate source.
In that lookalike source, one commit added a single build setting that bundled a hidden “cook” folder into the package. A later commit copied the same folder into the Dockerfiles. Notably, the tagged release did not include that change. Socket warns that “reviewing the tag alone would therefore miss this packaging change.”
Socket also stresses what remains unknown. The evidence does not show how the override was approved or whether an account or token was stolen.
Infection chain
The wheels drop three files into Python’s library folder. One is a .pth file, which Python runs on every startup. The other is a sitecustomize script, which Python also loads automatically.
So this PyPI credential stealer does not wait for LiteLLM. Any Python launch in the environment can trigger it. Socket adds a warning: running Python or pip to inspect or repair the install “can execute the payload again.”
Floating container tags widen the risk. On October 21, the “latest,” “main-latest,” and “main-stable” tags all pointed to the bad image. Upwind also reports affected database and non-root image variants, plus an image on Docker Hub.
Command-and-control and data exfiltration
Sixteen collection modules
The stealer runs 16 modules, each with its own error handling. It grabs AWS, Azure, Google Cloud, Kubernetes, Vault, and Terraform credentials. It also takes SSH, GPG, and TLS keys, Git tokens, .env files, and browser databases.
AI tools are a clear target. The stealer reads login files for Codex, Claude, Gemini, and Cursor, plus configs for Copilot, Windsurf, and Hugging Face. One module even queries a LiteLLM proxy’s saved credentials and model settings.
Encrypted upload
Next, the stealer encrypts its findings with AES-256 and wraps the key with RSA-4096. It then posts the archive to a lookalike LiteLLM domain under a “healthcheck” path. After a successful upload, it writes a hidden marker file to avoid repeat collection.
A loader waiting for orders
Meanwhile, the sitecustomize file starts a detached background process. Every hour, it reads a domain name from a file in a GitHub repository. If that file names a live server, the loader downloads Python code and runs it. Socket notes there is “no signature or content-hash verification.”
When Socket checked, the GitHub file was empty. However, the attacker can change it at any time.
Defense and detection guidance
Key steps include:
- Block litellm 1.107.0 and stop deploying affected image tags or digests.
- Check lockfiles, caches, CI logs, and running containers, including any using floating tags.
- Isolate affected hosts before you run Python or pip on them.
- Rotate every secret the Python process could read, from a clean machine.
- Rebuild from a reviewed release and pin image digests. Upwind recommends 1.106.2.
- Search egress logs for “healthcheck” uploads and unexpected downloads of Python code.
- Maintainers should limit release builds to approved repository owners and reviewed commits.
Overall, this LiteLLM supply chain attack shows that build provenance only helps if teams check where the source came from.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
