Malicious Update to Widely Used AI Software Stole Cloud Credentials for Nearly Two Hours

A tampered software release briefly infiltrated one of the most widely used tools for connecting applications to artificial intelligence models, exposing cloud credentials, API keys and other secrets on an unknown number of machines before the malicious code was removed. The incident, disclosed October 21 by the maintainers of LiteLLM, began when attackers compromised the project's release pipeline and published a doctored version of the software to the Python Package Index and to Docker's container registries.

LiteLLM is an open-source "AI gateway" maintained by a company called BerriAI that lets developers route calls to more than 100 large-language-model providers, including OpenAI and Anthropic, through a single interface. According to BerriAI's own description of the project, it has been pulled more than 240 million times from Docker's registries and has handled over a billion requests, making it a common piece of infrastructure inside companies building AI-powered applications.

A Narrow but Dangerous Window

In a detailed incident report published on its documentation site, LiteLLM said the compromised package, version 1.107.0, reached the Python Package Index, or PyPI, at 11:39 UTC on October 21 and was removed roughly 100 minutes later. Corresponding container images on Docker Hub and GitHub's container registry, tagged both with the version number and with the "latest" label that many deployments pull automatically, remained available for close to two and a half hours before being taken down. Security researchers at Wiz and at Datadog's Security Labs independently confirmed the same timeline after analyzing the malicious artifacts.

The malicious release dropped three files — named cook.pth, cook.py and sitecustomize.py — into a target machine's Python installation. Because Python automatically executes files with those names every time the interpreter starts, the malware would run on a compromised machine even if a developer never directly imported the LiteLLM library, researchers at Wiz and Datadog found. One component acted as an information stealer, searching for Amazon Web Services, Google Cloud and Microsoft Azure credentials, browser-saved passwords and cookies, SSH and GPG keys, and API keys for AI providers such as OpenAI, Anthropic and Cohere. A second component installed an hourly check-in to a file hosted on GitHub that could, in theory, direct the infected machine to download and run additional code — a mechanism Wiz said it had not previously documented in combination with the first technique.

A Lookalike Repository and Stolen Tokens

According to both LiteLLM's own account and Wiz's independent analysis, the attackers did not simply upload malware to an existing account. They obtained OAuth tokens tied to the GitHub command-line tool from three LiteLLM engineers — tokens LiteLLM said may have leaked through logs on an internal company system that was unexpectedly exposed to the public internet. Using one token, the attackers overrode branch-protection rules on the project's private release workflow; using others, they triggered and approved a production release that pulled its source code not from BerriAI's legitimate repository but from a decoy repository whose name, "Berri-AI/litellm," differed from the real one by a single hyphen. Wiz said the attackers had pushed ten commits to that lookalike repository in the hours beforehand, nine of them cryptographically signed, writing that "the commits remain reachable through the legitimate parent repository because of Git's fork object sharing" — a detail that let the forged build pass automated provenance checks. LiteLLM also said a set of workflow logs was deleted during the intrusion, hampering its own investigation.

The attacker had to compromise multiple independent security controls to be successful.

That assessment came from LiteLLM's own post-incident report, signed by the company's director of security, Oliver Jensen, along with chief executive Krrish Dholakia and chief technology officer Ishaan Jaffer. The company said it has not yet confirmed exactly how the attackers first gained access to its internal systems, saying only that it suspects "a recently patched vulnerability."

Second Breach of the Year

This is not the first time LiteLLM's supply chain has been compromised this year. In March, two other versions of the package were found carrying credential-stealing code after the project's continuous-integration pipeline was breached, in an intrusion security researchers later tied to a group tracked as TeamPCP. LiteLLM and outside researchers said Tuesday's attack is not yet known to be connected to the earlier one, though both followed a similar pattern: a brief window in which a tainted package sat on PyPI before removal, followed by a scramble to identify which organizations had installed it. Researchers at Chainguard, a software-supply-chain security firm, wrote that the repeat incident underscores how attractive AI infrastructure tools have become as targets, since they routinely hold credentials for both cloud platforms and AI providers in one place.

What Comes Next

Wiz said that roughly four and a half hours after the credential-stealing code began exfiltrating data, it observed the attackers actively testing stolen Amazon Web Services credentials taken from automated build systems and cloud computing clusters — activity consistent with what researchers call "LLMjacking," in which stolen credentials are used to run up charges on victims' AI-provider accounts rather than, or in addition to, more conventional data theft.

LiteLLM is urging any organization that installed or deployed version 1.107.0 to treat the incident as a confirmed breach rather than a near-miss. Its recommended response includes:

• Downgrading to version 1.106.2, the last confirmed clean release, and rebuilding affected environments from scratch rather than simply upgrading
• Manually searching for and deleting the cook.pth, cook.py and sitecustomize.py files, which are not removed by uninstalling the LiteLLM package itself
• Rotating every credential reachable from an affected machine, including cloud provider keys, AI provider API keys, database passwords and any keys stored in LiteLLM's own proxy database
• Reviewing cloud audit logs for signs that those credentials were used from outside the organization's own infrastructure

The company said it has revoked the compromised developer credentials and pared back internal release permissions to a minimal set while its investigation continues. It has not said how many organizations installed the compromised package during the roughly two-and-a-half-hour window, and researchers cautioned that the true scope may not be known for some time, since the malware was designed to persist even after the LiteLLM package itself is removed.