LiteLLM 1.107.0 Was Trojaned: Check for It and Rotate Your AI Keys

Attackers compromised LiteLLM’s release process on Wednesday and pushed a malicious 1.107.0 to PyPI and Docker. It steals cloud and AI credentials and drops a remote access trojan.

What to know

• PyPI quarantined it within hours, and the litellm/litellm:1.107.0 image was pulled from Docker Hub and GHCR. Anyone who ran it should assume their secrets are gone.
• The Docker latest, main-latest and main-stable tags pointed at it too. The last safe version is 1.106.2.
• The payload came from a look-alike GitHub org, Berri-AI (with a hyphen), not the real BerriAI.
• Three files: cook.pth and cook.py (the infostealer, run every time Python starts) and sitecustomize.py (the RAT, which polls for commands every hour).
• It grabs browser passwords and cookies, AWS, Google Cloud and Azure credentials, environment variables, SSH keys, and API keys for OpenAI, Anthropic, Cohere and others.
• Aikido says to look for /tmp/.pc_once_* (the data already left) and /tmp/remote_code_loader.lock (the RAT ran).

My take

AI gateways sit right next to all your keys, which makes them a juicy target. Pin versions, and if you touched 1.107.0, rotate everything.

Have a blessed day! And Happy Hacking!

References & Further Reading

• LiteLLM supply chain attack hoovers up passwords and secrets (The Register)
• LiteLLM releases (GitHub)