Supply Chain Attack Compromises LiteLLM PyPI Package, Stealing AI and Cloud Credentials
On October 21, 2026, security firm Socket uncovered a supply chain attack targeting LiteLLM, a widely used Python package that provides a unified interface for large language model (LLM) providers. Attackers compromised version 1.107.0 of the package on PyPI, distributing malicious container images designed to exfiltrate sensitive credentials, including AI provider keys, cloud credentials, and developer secrets.
LiteLLM, which averages 23 million weekly downloads, serves as a proxy for major LLM providers, making its compromise particularly high-risk. The malicious packages targeted Windows, Linux, and macOS environments, with Socket’s scanner detecting the threat within seven minutes of publication.
Attack Mechanics
The attackers leveraged a typosquatted repository Berri-AI/litellm (with an extra hyphen) instead of the legitimate BerriAI/litellm to publish the malicious build. The compromised version introduced a cook directory via modified Maturin configuration and Dockerfile instructions, embedding malware in three startup files:
cook.pth(executesimport cookduring Python interpreter startup)cook.py(collects credentials)sitecustomize.py(launches a detached loader)
The malware, dubbed privcollect, includes 16 modules targeting:
- Cloud credentials (AWS, Azure, Google Cloud)
- Kubernetes, Docker, Git, and SSH keys
- Environment variables and browser databases
- Authentication files for Codex, Claude, Gemini, and Cursor
For LiteLLM deployments with a DATABASE_URL configured, the malware executed queries against LiteLLM_CredentialsTable and LiteLLM_ProxyModelTable, extracting up to 500 records from each.
Exfiltration & Persistence
Collected data was AES-256-CBC encrypted and uploaded to hxxp://www[.]litellm[.]dev/healthcheck, with the encryption key secured via RSA-4096 OAEP. Additionally, sitecustomize.py fetched a loader script from a GitHub repository (letters9813/pythonclient-test), which could execute arbitrary Python code without signature verification.
The attack extended beyond the explicitly compromised version latest, main-latest, and main-stable tags also resolved to the malicious image.
Response & Mitigation
Socket advised affected organizations to:
- Block version 1.107.0 and halt deployments of compromised images.
- Isolate environments where Python executed post-installation.
- Rotate exposed credentials from clean systems.
- Rebuild environments from verified artifacts, as simply removing LiteLLM does not eliminate the malware’s startup files or terminate active loaders.
Indicators of Compromise (IoCs)
- Package:
litellm==1.107.0 - Exfiltration URL:
hxxp://www[.]litellm[.]dev/healthcheck - Loader URL:
hxxps://raw[.]githubusercontent[.]com/letters9813/pythonclient-test/main/domain.txt - File Hashes:
cook.py(SHA-256):9dd0a3926f96a37eb86cf1ee2310d9be93139cc4ebef3ef9e2efe9531390be25sitecustomize.py(SHA-256):34bef04fe88ac9d0aae0475630b1738681d15b94f233ac8aa46eacf5968305faSource: https://cyberpress.org/hackers-compromise-litellm-pypi-package/
BerriAI TPRM report: https://www.rankiteo.com/company/litellm
LiteLLM TPRM report: https://www.rankiteo.com/company/litellm
"id": "lit1792657523",
"linkid": "litellm",
"type": "Cyber Attack",
"date": "10/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': 'Users of LiteLLM version '
'1.107.0 (23 million weekly '
'downloads)',
'industry': 'Artificial Intelligence / Cloud Services',
'name': 'LiteLLM',
'type': 'Software Package'}],
'attack_vector': 'Typosquatted repository and malicious package distribution '
'via PyPI',
'data_breach': {'data_encryption': 'AES-256-CBC (exfiltrated data)',
'data_exfiltration': True,
'file_types_exposed': ['Python startup files (.pth, .py), '
'database records'],
'number_of_records_exposed': 'Up to 500 records from '
'LiteLLM_CredentialsTable and '
'LiteLLM_ProxyModelTable',
'personally_identifiable_information': True,
'sensitivity_of_data': 'High (credentials, PII, '
'authentication tokens)',
'type_of_data_compromised': ['AI provider keys',
'Cloud credentials',
'Kubernetes/Docker/Git/SSH keys',
'Environment variables',
'Browser databases',
'Authentication files',
'LiteLLM database records']},
'date_detected': '2026-10-21',
'date_publicly_disclosed': '2026-10-21',
'description': 'On October 21, 2026, security firm Socket uncovered a supply '
'chain attack targeting LiteLLM, a widely used Python package '
'that provides a unified interface for large language model '
'(LLM) providers. Attackers compromised version 1.107.0 of the '
'package on PyPI, distributing malicious container images '
'designed to exfiltrate sensitive credentials, including AI '
'provider keys, cloud credentials, and developer secrets.',
'impact': {'brand_reputation_impact': 'High (LiteLLM averages 23 million '
'weekly downloads)',
'data_compromised': 'AI provider keys, cloud credentials, '
'Kubernetes/Docker/Git/SSH keys, environment '
'variables, browser databases, authentication '
'files for Codex/Claude/Gemini/Cursor, LiteLLM '
'database records',
'identity_theft_risk': 'High (exposure of PII and authentication '
'credentials)',
'operational_impact': 'Potential unauthorized access to AI and '
'cloud services, credential rotation '
'required, environment rebuilds necessary',
'systems_affected': 'Windows, Linux, macOS environments using '
'LiteLLM'},
'initial_access_broker': {'backdoors_established': 'Malicious startup files '
'(cook.pth, cook.py, '
'sitecustomize.py)',
'entry_point': 'Typosquatted repository '
'(Berri-AI/litellm)',
'high_value_targets': 'AI provider keys, cloud '
'credentials, LiteLLM '
'database records'},
'investigation_status': 'Ongoing',
'motivation': 'Credential theft (AI provider keys, cloud credentials, '
'developer secrets)',
'post_incident_analysis': {'corrective_actions': 'Enhanced package '
'verification, stricter '
'repository naming policies, '
'improved credential '
'rotation procedures',
'root_causes': 'Typosquatted repository, '
'compromised package version '
'(1.107.0), lack of signature '
'verification for loader scripts'},
'ransomware': {'data_exfiltration': True},
'recommendations': ['Block and avoid using LiteLLM version 1.107.0',
'Rotate all exposed credentials from clean systems',
'Rebuild environments from verified artifacts',
'Monitor for unauthorized access to AI/cloud services',
'Verify package sources to avoid typosquatting'],
'references': [{'date_accessed': '2026-10-21',
'source': 'Socket Security Advisory'}],
'response': {'communication_strategy': 'Public advisory by Socket',
'containment_measures': 'Block version 1.107.0, halt deployments '
'of compromised images, isolate '
'environments where Python executed '
'post-installation',
'remediation_measures': 'Rotate exposed credentials from clean '
'systems, rebuild environments from '
'verified artifacts',
'third_party_assistance': 'Socket (security firm)'},
'stakeholder_advisories': "Socket's public advisory to affected organizations",
'title': 'Supply Chain Attack Compromises LiteLLM PyPI Package, Stealing AI '
'and Cloud Credentials',
'type': 'Supply Chain Attack',
'vulnerability_exploited': 'Compromised package version (1.107.0) with '
'embedded malware'}