LiteLLM hit by supply chain attack again: stealer drains SSH keys, cloud secrets and AI provider keys
AIFlow_ML · x · 2026-10-22
The LiteLLM AI gateway library was compromised again in a supply chain attack: version 1.107.0 on PyPI was built from a lookalike repo (Berri-AI/litellm). PyPI has removed the version and the infected Docker images (latest, main-latest, main-stable) were yanked.
The malware uses a cook.pth credential stealer plus a sitecustomize RCE loader:
- Executes whenever Python starts, harvesting browser passwords, SSH keys, cloud/container credentials, GPG/TLS private keys, env vars and Claude Code configs
- Queries LiteLLM's own database (LiteLLMCredentialsTable) to steal every stored AI provider API key
- Exfiltrates AES+RSA-encrypted data via a fake healthcheck endpoint and supports remote code loading
Users should pin to a safe version like v1.106.2 by digest.
More from coding & agent
- SF Systems meetup: agents-only version control Tally, and Postgres rewritten in Rust for 900x faster analytics — ShadajL · 2026-10-22
- dsh-prompt-layer plugin injects your rules into DSH's system prompt, overriding AGENTS.md — teortaxesTex · 2026-10-22
- LLM writing still garbage in 2026, dev shows the blunt prompt he uses — arthurcolle · 2026-10-22
- "Patch my PHP vulnerabilities" — Claude also refactors 37 files and breaks the app — petrusenko_max · 2026-10-22
- He hooked a cheap receipt printer to Claude for proactive daily printouts — beglen · 2026-10-22
- Nous Research ships official Hermes Agent plugin for Meshy AI 3D generation via MCP — NousResearch · 2026-10-22