Trojanised LiteLLM release steals cloud and AI provider keys

Attackers compromised the release process of LiteLLM, the open source AI gateway developed by BerriAI, on 21 October 2026 and published a trojanised version 1.107.0 to PyPI and Docker registries, according to The Register. The package contained malware designed to steal cloud and AI credentials, plus a remote access trojan (RAT) able to run arbitrary code on infected machines. PyPI quarantined the version within hours and the Docker image litellm/litellm:1.107.0 was pulled from Docker Hub and GHCR soon after, but anyone who ran the compromised package on any platform should assume their secrets have been stolen.

The malicious version was uploaded at 11:39 UTC. According to Wiz researchers Benjamin Read and Rami McCarthy, the payload came from malicious commits made on a GitHub repository named Berri-AI/litellm, a hyphenated variant of the legitimate BerriAI organisation. That repository was used to inject three files into the LiteLLM release pipeline.

Aikido Security malware hunter Ilyas Makari said the files were cook.pth, which makes a second file, cook.py, run automatically every time Python is invoked on the machine with no further user action; cook.py, which contains the infostealer; and sitecustomize.py, which is the RAT. Python also runs the RAT at interpreter startup, spawning a background daemon that polls the attacker's infrastructure every hour for new commands.

The infostealer harvests data across 16 modules targeting browsers, cloud providers and AI services, Read and McCarthy said. It takes browser credentials and cookies from Chrome, Firefox, Edge and Safari, AWS credentials from ~/.aws/, environment variables and EC2/ECS instance metadata, Google Cloud service account keys and application default credentials, and Microsoft Azure tokens from the CLI cache. It also collects API keys for OpenAI, Anthropic, Cohere and other LLM providers, along with SSH private keys, GPG keys and shell history files. The stolen data is encrypted with AES-256-CBC, the key wrapped with an RSA-4096 public key, and the result sent by HTTP POST to an attacker-controlled domain, www[.]litellm[.]dev/healthcheck.

Makari advised users to check for the files /tmp/.pc_once_*, which indicates the exfiltration has already fired, and /tmp/remote_code_loader.lock, which indicates the command-and-control daemon ran or is still running. The same checks apply to anyone who ran the official Docker image litellm/litellm:1.107.0, or pulled it via the latest, main-latest or main-stable tags. The most recent safe version is v1.106.2.

"Teams using 1.107.0 should stop deploying it and investigate environments where Python ran after installation, including proxy containers and CI runners," Socket researchers said on 21 October 2026.

LiteLLM provides a common interface for LLM providers including OpenAI, Anthropic and Google Gemini, and receives about 23 million weekly downloads, The Register reported. That means a compromised installation can sit alongside LLM provider API keys, cloud identities and database connection strings.

The scale of the incident is not yet known. An earlier LiteLLM compromise in March potentially exposed more than 2,500 organisations and 434,000 CI/CD pipelines worldwide, according to CloudSEK. Aikido, Wiz and Socket have each published threat-hunting and mitigation instructions for LiteLLM users and security teams. BerriAI did not respond to The Register's inquiries.