Fool me once, shame on you. Fool me twice, and I'm rotating every credential I've ever owned. LiteLLM, the popular open-source gateway that lets apps talk to dozens of AI models through one interface, has been hit by its second supply chain attack this year.
One Bad Release, Seven Builds Deep
On October 21, a malicious LiteLLM v1.107.0 landed on PyPI and Docker. The PyPI package was live from 11:39 to 13:23 UTC, and the Docker images from 11:46 to 14:20 UTC. The payload went after cloud credentials (AWS, Azure, Google Cloud, Kubernetes, Docker), SSH and GPG keys, browser logins, shell history, and auth files for AI coding tools like Codex, Claude, Gemini, and Cursor.
The nastiest trick: the malware planted code in Python startup files, so it ran whenever Python started in an affected environment, even if LiteLLM was never imported. About four and a half hours after the data was stolen, the attacker started testing stolen AWS credentials and checking access to Amazon Bedrock AI models.
Three Stolen Tokens and a Typo-Squat
The attacker used stolen GitHub CLI OAuth tokens from three LiteLLM engineers: one to modify the pipeline and trigger the release, one to approve it, and one to delete workflow records. LiteLLM suspects the tokens were harvested from the logs of an internal deployment exposed to the public internet, and notes that Claude Code can embed GitHub CLI tokens in response bodies, which may end up in logs. Build records also show a repository named Berri-AI/litellm, one hyphen away from the real BerriAI/litellm.
The bigger lesson is that AI gateways are now prime targets precisely because they hold the keys to everything. An earlier LiteLLM attack in March was linked to roughly 2,500 exposed organizations. If your AI integration sits in the middle of your infrastructure, it deserves the same paranoia as your database. Socket found the poisoned release in seven builds across macOS, Linux, and Windows, so "we only use it on dev laptops" is not the comfort it sounds like.
The fix: move to v1.106.2 or another verified safe version, and if you installed v1.107.0, treat every credential on that machine as compromised. Updating alone won't save you. Also check your environment against the indicators of compromise published by Aikido, Wiz, and Socket, review AWS activity for unexpected credential checks and Bedrock usage, and audit Python startup files for code that shouldn't be there. Enterprise customers using LiteLLM's private registry were not affected.
If your business is wiring AI into its stack and you're not sure where the keys live, our free developer's checklist for defending against supply chain attacks is a solid place to start.
Source: Help Net Security