Affected Systems

LiteLLM Python package v1.107.0 on PyPI (Oct 21, 2026, 11:39-13:23 UTC) and Docker images v1.107.0, latest, main-latest, main-stable on Docker Hub and GHCR (11:46-14:20 UTC). Users who installed unpinned versions or used affected Docker tags during these windows are compromised. Linux and macOS systems face additional backdoor risk via sitecustomize.py.

Exploitation Status

Active exploitation confirmed. Stolen AWS credentials were validated and used for LLMjacking reconnaissance (bedrock:ListFoundationModels, IAM enumeration) starting 4.5 hours post-exfiltration from IPs 168.100.8.57 and 165.227.201.8. Malicious package contained credential stealer and hourly C2 backdoor.

Business Impact

Organizations using LiteLLM in CI/CD pipelines, Kubernetes clusters, or developer workstations during the compromise window face credential theft of system secrets, browser data, cloud provider keys (AWS, Azure, GCP), and AI tool tokens. Wiz observed attacker validation of stolen AWS credentials with attempts to enumerate IAM roles, users, and access keys. Backdoor provided persistent remote code execution capability via hourly C2 callbacks. LiteLLM suspects GitHub CLI OAuth tokens were leaked in AI gateway logs (Claude Code responses), enabling attackers to bypass branch protections and publish signed malicious artifacts.

Urgency

🔴 Immediate

Recommended Actions

  • Immediately rotate all credentials and API keys on systems that installed LiteLLM v1.107.0 or used Docker tags latest, main-latest, or main-stable between Oct 21 11:39-14:20 UTC, including AWS/Azure/GCP keys, GitHub tokens, and AI service credentials
  • Search for indicators of compromise: check for /tmp/remote_code_loader.lock file on Linux/macOS, review outbound connections to litellm[.]dev/healthcheck and github[.]com/letters9813, and audit AWS CloudTrail for sts:GetCallerIdentity or bedrock:ListFoundationModels calls from IPs 168.100.8.57 or 165.227.201.8 between Oct 21 16:20-17:01 UTC
  • Upgrade to LiteLLM v1.107.1 or later and re-pull Docker images after Oct 21 14:20 UTC; pin package versions in requirements.txt and Dockerfiles to prevent automatic updates to compromised releases
  • Review LiteLLM gateway logs for embedded GitHub CLI OAuth tokens in Claude Code API response bodies; rotate any exposed tokens and disable logging of full response payloads
  • Audit GitHub organization access: revoke CLI tokens for accounts with workflow execution permissions, enable branch protection rules, and review recent workflow runs for references to lookalike repository Berri-AI/litellm (capital 'B' in second position)