LiteLLM PyPI package and Docker image compromised, used to steal cloud and AI credentials
LiteLLM PyPI Package and Docker Images Compromised to Steal Cloud and AI Credentials
The PyPI package and Docker image of LiteLLM 1.107.0 were implanted with a credential stealer, and Socket's AI scanner flagged all 7 wheels 7 minutes after release. The malicious Python startup file activates as soon as the interpreter starts, without the application needing to import LiteLLM; it collects cloud credentials such as AWS, Azure, and Google Cloud, SSH and GPG private keys, browser data, and authentication files of AI tools such as Codex, Claude, Gemini, and Cursor, encrypts them, and exfiltrates them to www.litellm.dev/healthcheck; another loader pulls remote Python code from the GitHub repository letters9813/pythonclient-test for execution.
The article provides the affected versions, the malicious startup hook mechanism, and an IOC list, which teams deploying LiteLLM can use to check their environments and rotate credentials.