Poisoned LiteLLM Package Hunts for Cloud and AI Credentials

Wiz Research reports that a malicious version of the LiteLLM package (1.107.0) was uploaded to PyPI on October 21 at 11:39 UTC. It was quarantined later, and trojanized LiteLLM Docker images on GHCR and Docker Hub were removed at about 13:53 UTC. Affected tags included v1.107.0, latest, main-latest and main-stable. The most recent safe version is v1.106.2.

Once installed, the package drops three files into the Python environment that run whenever a Python interpreter starts. One of them unpacks itself and runs a credential stealer. The stealer collects system, browser, developer, cloud and AI tool secrets, encrypts them and sends them to an attacker-controlled domain that impersonates LiteLLM infrastructure. Targets include browser credentials and cookies, AWS and GCP credentials, SSH and GPG keys, shell history, and API keys for providers such as OpenAI and Anthropic.

A second script, which runs only on Linux and macOS, tries to fetch an address from a GitHub repository and then download a further Python stage. At the time of analysis, that file had never been populated, and the repository has since been taken down. Even so, any system that ran the bad version should be treated as exposed, because the stealer could already have sent secrets out.