The Anatomy of the LiteLLM Supply-Chain Compromise
Attackers successfully compromised the LiteLLM release pipeline to distribute info-stealer malware by exploiting exposed internal logs containing stolen GitHub CLI OAuth tokens. LiteLLM is an open-source large language model gateway developed by BerriAI, founded by Ishaan Jaffer and Krrish Dholakia, that provides a unified OpenAI-compatible application programming interface for accessing and routing requests to different model providers as noted on Wikipedia. According to TechCrunch, malicious versions of LiteLLM were previously distributed through the Python Package Index as part of a software supply-chain attack in March 2026, which led the project maintainers to harden their release pipeline by moving releases to a private repository, making Docker release tags immutable, and signing Docker images according to The Hacker News. However, temporary permission expansions created the window for this latest attack, according to The Hacker News. Think of an AI gateway like a central hub terminal in a busy transit system, where a single compromised set of keys at the control desk can let an unauthorized train onto every active track.
Here is what happened in plain terms during the October 21, 2026 incident. According to Wiz, the malicious version 1.107.0 was uploaded to PyPI at 11:39 UTC on October 21, and was quarantined at 13:20 UTC after receiving approximately 49,000 downloads. LiteLLM Docker containers on GHCR and Docker Hub also included the trojanized version under tags including v1.107.0, latest, main-latest, and main-stable, which were removed around 13:53 UTC according to Wiz. The Hacker News noted that the incident began around 4:00 a.m. PST, impacting users who downloaded unpinned versions via pip or used specific Docker images between 11:46 a.m. and 2:20 p.m. UTC. The most recent safe version prior to the incident is v1.106.2, according to Wiz.
How Stolen OAuth Tokens Bypassed Automated Security Controls
The threat actors bypassed automated security controls by using stolen GitHub CLI OAuth tokens obtained from an exposed internal deployment, according to Wiz. Wiz identified an unexpected, innocuously named user account in an internal LiteLLM deployment that was exposed to the public internet. The attackers gained access to this deployment, obtained the GitHub CLI OAuth tokens from its logs, and used those credentials to compromise the release workflow, according to Wiz. The Hacker News reported that the threat actors compromised multiple independent security controls to push the malicious package.
The mechanics of the pipeline takeover involved coordinated credential usage across multiple accounts. According to Wiz, malicious actions were taken through three engineers’ GitHub accounts via stolen GitHub CLI OAuth tokens, where the threat actor used one user’s account to trigger the project-releaser run and another user’s account to approve it. All tokens involved in this attack have since been revoked, according to Wiz. After a thorough investigation, Wiz observed specific situations in which Claude Code will embed a user’s GitHub CLI OAuth token into a response body, and in situations where response bodies are logged, these tokens may appear in LiteLLM logs.
The Role of AI-Aided Malware in Modern Credential Theft
Once installed, the malicious package used a sophisticated dual-technique approach to ensure execution on Python startup. According to Wiz and The Hacker News, when the package is installed, three files are extracted directly into the site-packages root: cook.pth, cook.py, and sitecustomize.py, which are designed to execute whenever a Python interpreter starts. The Python interpreter processes cook.pth, which includes a command to import cook and load cook.py, a script that deobfuscates itself, runs a stealer routine named privcollect, and writes a maker to /tmp/.pc_once_72129118c59f5636c0bb according to Wiz and The Hacker News. The stealer routine gathers system, browser, developer, cloud, and AI tool secrets, encrypts them, and exfiltrates the data to litellm.dev/healthcheck via an HTTP POST request to an attacker-controlled domain impersonating LiteLLM infrastructure according to Wiz and The Hacker News.
The malware also functioned as a remote access trojan. According to The Hacker News, citing Aikido researcher Ilyas Makari, the interpreter attempts to execute sitecustomize.py, which runs only on Linux and macOS machines and fetches domain.txt from a GitHub dead drop at github.com/letters9813. The daemon forks a background instance, acquires a lock at /tmp/remote_code_loader.lock to prevent multiple instances, enters an infinite loop, and every hour fetches the attacker’s current command and control domain before fetching and executing a Python payload from that domain according to The Hacker News. Wiz noted that the text file was populated only with initial test values prior to its takedown by GitHub around 1:30 p.m. UTC. Additionally, Wiz observed post-exploitation activity starting about 4.5 hours post-exfiltration, where the attacker validated AWS instance role credentials captured from compromised CI runners and Kubernetes nodes between 4:20 p.m. and 5:01 p.m. UTC. Each credential was checked with sts:GetCallerIdentity, followed by bedrock:ListFoundationModels and a ListModels call, consistent with LLMjacking, while in a small number of environments the attacker also performed general IAM enumeration and general discovery according to Wiz.
The structure of the malware’s code exhibited distinct traits of AI-assisted development. According to Wiz, the payload had strong indications of LLM-aided development, including verbose variable names such as encrypted_private_key_output, overly defensive error handling with generic try and except blocks, platform-specific code paths that fail silently on untested platforms, and a dead code module named exec_py that was defined but never called. This structure suggests iterative prompting, yielding code that is functional on the happy path but brittle at the edges and untested according to Wiz.
Lessons for Securing AI Toolchains and CI/CD Pipelines
Mitigation strategies for developers using LLM gateways require rigorous dependency management and active log auditing. Developers are advised to pin dependencies and audit CI/CD logs for sensitive credentials such as OAuth tokens according to Wiz and The Hacker News. For teams relying on AI coding tools and gateways like LiteLLM, understanding the practical upshot of this incident means treating internal logging outputs with the same security rigor as production databases. By maintaining strict permission boundaries, avoiding temporary expansions in release pipelines, and constantly checking for exposed command-line interface tokens in log files, organizations can better protect their software supply chains against automated and AI-assisted threats.
Sources
- LiteLLM
- LiteLLM Compromised, Steals Credentials | Wiz Blog
- LiteLLM Suspects GitHub Token Leak in AI Gateway Logs Behind Malicious Package Release
Photo: NOIRLab/NSF/AURA/T. Slovinský (CC BY 4.0)
