Stolen GitHub Tokens Fuel LiteLLM Supply Chain Breach
Attackers used stolen access tokens from three LiteLLM engineers to hijack the project's release process and publish a poisoned version 1.107.0 of LiteLLM, a popular open-source AI gateway downloaded about 23 million times a week.
Summary
- First Seen
- October 2026
- Targeted Regions
- Worldwide
- Targeted Platforms
- Linux, macOS, Windows, Docker containers, Kubernetes, CI/CD runners
- Targeted Products
- LiteLLM (PyPI package litellm
1.107.0; Docker images litellm, litellm-database and litellm-non_root atv1.107.0, latest, main-latest and main-stable on GHCR and Docker Hub) - Malware
- privcollect, Unnamed Backdoor
Attackers used stolen access tokens from three LiteLLM engineers to hijack the project's release process and publish a poisoned version 1.107.0 of LiteLLM, a popular open-source AI gateway downloaded about 23 million times a week. The malicious version was live on PyPI and Docker for roughly two hours. It ran automatically whenever Python started on an affected machine, stealing cloud keys, AI provider API keys, browser passwords, SSH keys, and CI/CD secrets, and sending them to the lookalike domain. It also planted a hidden backdoor that let the attackers run new code later. Within hours, the attackers were testing stolen AWS credentials to access cloud AI services, so any organization that installed this version should treat those systems as compromised, remove it, and rotate every credential those systems could reach.
Attack Details
In October 2026, attackers hijacked the release process of LiteLLM, a popular open-source tool that companies use to connect their applications to AI models such as OpenAI, Anthropic, and AWS Bedrock, and that is downloaded about 23 million times a week. Using stolen access tokens belonging to three LiteLLM engineers, the attackers quietly pointed the project's official build system at a copycat code repository, Berri-AI/litellm, whose name differs from the real one by a single hyphen. The result was a poisoned LiteLLM version 1.107.0 that went out through the project's normal download channels, PyPI and Docker, looking like a routine update. The attackers also deleted build records afterwards.
The attack was planned at least a week in advance, with a lookalike website, litellm[.]dev, and a supporting GitHub account set up on October 13. The poisoned version was live on PyPI for under two hours and on Docker for roughly two and a half hours before it was removed. The malicious version was spotted within minutes of its release, but anyone who installed or updated LiteLLM during that window, including automated build pipelines that pull the latest version, received the malicious code.
The malicious code ran on its own every time Python started on an affected machine, even if LiteLLM itself was never used. It had two parts. The first was privcollect, a credential stealer that gathered almost every secret it could find: cloud account keys for AWS, Azure, and Google Cloud, passwords and cookies saved in web browsers, SSH keys, credentials for code and package platforms, CI/CD pipeline secrets, and login tokens for AI coding assistants. On LiteLLM servers, privcollect also took the stored API keys for every AI provider the server connects to. All of this was encrypted and sent to the attackers' lookalike website. The second part was a hidden backdoor that checked in with the attackers every hour, so they could push and run new code on infected machines whenever they chose. The backdoor had not yet been switched on when it was discovered.
The stolen data was put to use quickly. About four and a half hours after privcollect sent its stolen data, the attackers were seen testing stolen AWS credentials and using them to access cloud AI services, a pattern known as LLMjacking, in which attackers run up AI usage on a victim's account. The same delivery trick was used in an earlier LiteLLM compromise reported in March 2026 attributed to TeamPCP. Any organization that installed LiteLLM 1.107.0 or pulled the affected Docker images should treat that system as compromised, remove the malicious version, and change every password, key, and token the system could reach.
Recommendations
- 01Remove LiteLLM 1.107.0 Without Starting PythonDo not run pip install or any Python command first in an affected environment, since every interpreter start re-triggers the payload. From the shell, delete
cook.pth,cook.py,sitecustomize.pyand any cook .pyc or sitecustomize .pyc files in __pycache__ from every affected site-packages directory. - 02Kill the Detached Backdoor DaemonIdentify and terminate the Python process holding
/tmp/remote_code_loader.lock(for example with lsof). It runs detached with parent PID 1 and working directory /, and uninstalling the package does not stop it. - 03Pin a Known-Clean LiteLLM Version by DigestReinstall litellm==
1.106.2and pin container images tov1.106.2by digest. Prefer rebuilding virtual environments and images from scratch over cleaning them in place, and stop using floating tags such as latest, main-latest and main-stable. - 04Purge Cached Malicious ArtifactsSearch lockfiles, requirements files, internal PyPI mirrors, pull-through caches and container registries for litellm
1.107.0wheels, the sdist and the listed image digests, and remove them. Review open-ended constraints such as litellm>= that may have resolved to1.107.0during the exposure window. - 05Treat Exposed Hosts as CompromisedAny host, container or CI runner that ran Python after installing
1.107.0with outbound internet access should be assumed to have exfiltrated its secrets. A missing/tmp/.pc_once_72129118c59f5636c0bbmarker does not prove a host is clean, as temp cleanup and container restarts can remove it. Isolate these systems and preserve evidence before rebuilding. - 06Rotate Every Reachable Credential from a Clean EnvironmentRotate instance and task IAM roles, cloud access keys, SSH, GPG and TLS keys, GitHub, npm, PyPI and registry tokens, Kubernetes and Vault tokens, CI/CD secrets, browser-stored passwords and sessions, AI coding tool tokens, and any secret present in the environment of any process on the host.
- 07Rotate LiteLLM Proxy SecretsOn LiteLLM proxy deployments, rotate all upstream provider API keys stored in the proxy database and model litellm_params, the master key, virtual keys, the salt key and the DATABASE_URL password, since the stealer dumps LiteLLM_CredentialsTable and LiteLLM_ProxyModelTable.
Indicators of Compromise (IoCs)
| Type | Value |
|---|---|
| SHA256 | 7f191632e7320705d154b85204f1ae546b543acbd7e8861229b76f5042b92bdb84dc8c82c0a4a4a62552ef826b49fcc86d1a5c4a5d0f2c06665723f93d129d7d9dd0a3926f96a37eb86cf1ee2310d9be93139cc4ebef3ef9e2efe9531390be2503ac2a8b752605d1d7710979c17ff18b03dd978203ba23ba97fd8ce3d6f897ea34bef04fe88ac9d0aae0475630b1738681d15b94f233ac8aa46eacf5968305fab6122440d0d9cb1eb1ade9933f49214da8c31288de7710c076c2680dfa5284656ea3d8ef6cf73a72d8df24f663b7a31ce67494eeb9b0d707b93484e66675d2df20a59e5a285799e7cf7fa16cfba1c1414f1e84a8459e14207cfd4e998c2cd24b7598727f209d717041db37f7dca271d3a7d328a279890e0e1d55375729aeb86d0aaf7ba346d41ef2f40390436738b001180d5a1c03aa093f121078a9969d9a1a668169d35b87bf51324080390b1b1c5ab12bd335cfe5f1a99e3689abd5e02ae6462d0c9f67ca522d9e0e4acd245e90b36ce0d5353604a66bb7c43a1ec4a6fcf7c2e32d0ce2548aa662c18bf5001911a79fe5b30cf8357132275add02fdcde0541bbce8caa94f01c0aaa0b7ddae51553a8a32e1ce53d96d44fe583272aff7ad0012d4ccc5c6f8d35cf4f2cf233b7f3e418e863e657d81ff5f5fc9e210005b94842befe2a79fb4fbbd9a543b5b40b530c8cffa8771bab22b8fb22b2e4ae3b1f8191bbcb1443bc962e45f5aad53fe3d2c30600e0379715fb6c664cdd3ac126c339ebd1aeee419ea36da9aa2b657288da4101887be468f020ac63d22ba6ed84a3ea556b74573eed6e4aafe4b50603dbe7853e0345f188c8e44a09f1098caf1f4bcdf24581ddc30767f16ecb69d2b0517556f2cd7dea56971adb42a3d1beb97d69523827dd893c74cf621a860a66a3a447a5c732533f087589ce905573e285c0a239c645a67d810628252d63df85dcc8824c58bcc77cf8383f4d3e6321f0ccc3ce9e4f75c8edae59b72b1ebfd617295833f465c85bb2fab9c1d60f21b496db86cb8da |
| IPv4 | 168[.]100[.]8[.]57165[.]227[.]201[.]8 |
| Domains | litellm[.]devwww[.]litellm[.]dev |
| URLs | hxxp[:]//www[.]litellm[.]dev/healthcheckhxxps[:]//raw[.]githubusercontent[.]com/letters9813/pythonclient-test/main/domain[.]txthxxps[:]//github[.]com/Berri-AI/litellm |
ckdi82fkoos[@]proton[.]meBerri-AI[@]users[.]noreply[.]github[.]com | |
| Filename | cook.pthcook.pysitecustomize.pylitellm-1.107.0-cp310-abi3-macosx_10_12_x86_64.whllitellm-1.107.0-cp310-abi3-macosx_11_0_arm64.whllitellm-1.107.0-cp310-abi3-manylinux_2_28_aarch64.whllitellm-1.107.0-cp310-abi3-manylinux_2_28_x86_64.whllitellm-1.107.0-cp310-abi3-musllinux_1_2_aarch64.whllitellm-1.107.0-cp310-abi3-musllinux_1_2_x86_64.whllitellm-1.107.0-cp310-abi3-win_amd64.whllitellm-1.107.0.tar.gz |
| File Path | /tmp/.pc_once_72129118c59f5636c0bb/tmp/remote_code_loader.lock/tmp/.pc_sq_\*/tmp/.pc_e_\*litellm-1.107.0.data/purelib/cook.pthlitellm-1.107.0.data/purelib/cook.pylitellm-1.107.0.data/purelib/sitecustomize.py/app/.venv/lib/python3.13/site-packages/cook.pth |
| HTTP Request | POST /healthcheckGET /codepyX-Token: XWiA8gZNa7NcX2XRoAEbUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0) |
| Environment Variable | PRIVCOLLECT_ACTIVE=1 |
| GitHub Repository | letters9813/pythonclient-testBerri-AI/litellm |
| Git Commit | 20535d8fa11f786a6c24df7488a0e449ed5f09ad783c43bc455d2e05d3cfaf194c2f325cfeab14339cf97e935aeaf791b9c8db224a2bb3ee156134ce |
MITRE ATT&CK TTPs
References & Patch Links
References
- https://github.com/BerriAI/litellm/issues/47826
- https://docs.litellm.ai/blog/security-incident-oct-21-2026
- https://www.wiz.io/blog/litellm-compromised-steals-credentials
- https://www.stepsecurity.io/blog/litellm-1-107-0-compromised-pypi-backdoored-wheels-credential-stealer
- https://www.hivepro.com/threat-advisory/teampcp-automated-supply-chain-from-trivy-to-litellm-in-a-multi-ecosystem-breach
What Next?
At Hive Pro, it is our mission to detect the most likely threats to your organization and to help you prevent them from happening.
.svg)