Affected Systems
LiteLLM Python package version 1.107.0 distributed via PyPI wheels (all platforms: macOS x86_64/ARM64, Linux x86_64/aarch64, Windows AMD64) and Docker images. Compromised through stolen GitHub CLI OAuth tokens from three engineer accounts.
Exploitation Status
Active supply chain attack. Malicious package was live on PyPI and delivered credential-stealing malware and backdoor to users who installed version 1.107.0. Package now quarantined on PyPI; malicious Docker images removed.
Business Impact
Organizations using LiteLLM 1.107.0 face immediate credential theft risk. Malware targets cloud credentials (AWS, Azure, GCP), private SSH keys, browser data, AI development tool credentials, and LiteLLM proxy configurations. Backdoor checks GitHub dead drop hourly for attacker commands. Credential exfiltration occurs via HTTP POST to litellm[.]dev/healthcheck. Attack vector (stolen GitHub tokens) remains under investigation, indicating potential for additional compromised accounts.
Urgency
🔴 Immediate
Recommended Actions
- Immediately identify all systems running LiteLLM 1.107.0 via package manager queries (pip list | grep litellm) and container image scans
- Isolate affected systems and revoke all cloud credentials, SSH keys, API tokens, and browser-stored credentials from a clean environment
- Roll back to LiteLLM 1.106.2 pinned by digest and block version 1.107.0 in dependency management tools (pip, Poetry, requirements.txt)
- Search logs for HTTP POST requests to litellm[.]dev/healthcheck and HTTP GET requests to domains retrieved from github[.]com/letters9813 to identify compromised hosts
- Monitor for unauthorized access using previously valid credentials across AWS, Azure, GCP, GitHub, and AI platform accounts (OpenAI, Anthropic, etc.)