LiteLLM release compromised again, prompting credential reset advice
A tampered LiteLLM version was published to PyPI and Docker and included code designed to steal cloud credentials, developer secrets, and AI API keys. LiteLLM said attackers used compromised GitHub accounts and tokens from an exposed internal deployment to alter its release process. The affected builds were removed, and users who installed them are being told to rotate credentials.
The poisoned build v1.107.0 appeared on PyPI for roughly one hour and 44 minutes and on Docker under four tags for about two hours and 34 minutes; v1.106.2 is the newest clean release. Investigators traced the intrusion to three engineer GitHub accounts, with stolen GitHub CLI OAuth tokens used to alter, approve, and then erase release-workflow evidence.
The company found an unanticipated account in a publicly reachable internal deployment and believes credentials were lifted from its logs. Socket estimates about 23 million weekly downloads and says seven platform-specific builds placed code in Python startup files, so it executes whenever Python launches, even without importing LiteLLM.
The incident could affect developers and organizations that rely on LiteLLM to connect applications to multiple AI providers, especially where cloud keys, source-control tokens, and CI/CD credentials share the same environment. If stolen secrets were used before rotation, attackers might reach cloud accounts, code repositories, or AI services, potentially exposing data or disrupting operations. Smaller teams may be less prepared to audit logs and rotate credentials quickly, while downstream customers could inherit risks from compromised vendors.