On October 21, 2026, a malicious version of LiteLLM (1.107.0) was published to PyPI. LiteLLM is a widely used open-source proxy that connects applications to more than 100 LLM providers.<\/p>\n\n\n\n
The compromised release contained an infostealer designed to exfiltrate credentials and a remote access trojan (RAT) capable of downloading and executing additional code. Stolen AWS credentials were reportedly abused within hours of the initial exfiltration.<\/p>\n\n\n\n
The malicious PyPI package was quarantined, and compromised Docker tags were removed. The latest reported safe version is<\/strong> 1.106.2<\/strong>.<\/strong><\/p>\n\n\n\n Organizations that installed or executed the compromised release should treat affected systems as potentially compromised and begin incident response immediately.<\/p>\n\n\n\n The attack originated from a lookalike GitHub repository, Berri-AI\/litellm, which was used to introduce malicious files and modify the release pipeline.<\/p>\n\n\n\n The attacker reportedly compromised three engineers\u2019 GitHub accounts using stolen GitHub CLI OAuth tokens. These accounts were used to trigger and approve a release, allowing the malicious version to reach PyPI and Docker registries.<\/p>\n\n\n\n Changes to pyproject.toml and Dockerfiles helped package and execute the malicious payload. The LiteLLM team subsequently revoked the compromised tokens.<\/p>\n\n\n\n The infostealer targeted a broad range of sensitive information, including:<\/p>\n\n\n\n The stolen data was encrypted before being exfiltrated to www.litellm[.]dev\/healthcheck, a lookalike domain impersonating LiteLLM infrastructure.<\/p>\n\n\n\n A separate payload, delivered through sitecustomize.py, attempted to contact a GitHub-hosted dead-drop repository every hour. If supplied with a usable command-and-control domain, it could retrieve and execute additional Python code.<\/p>\n\n\n\n Although no second-stage payload was observed during the initial analysis, the capability remained on infected systems.<\/p>\n\n\n\n The incident also progressed beyond credential theft. On October 21, suspicious AWS activity was observed from 168.100.8[.]57 and 165.227.201[.]8, including credential validation, Amazon Bedrock model enumeration, and IAM discovery. These activities are consistent with attempts to abuse stolen cloud credentials for unauthorized LLM usage and further reconnaissance.<\/p>\n\n\n\n Security teams should investigate the following indicators alongside their endpoint, network, and cloud audit logs:<\/p>\n\n\n\n These indicators may change or become inactive. Their absence does not prove that a system is clean.<\/p>\n\n\n\n Organizations that installed or executed the malicious release should:<\/p>\n\n\n\n Simply upgrading the package is not sufficient if the malicious code has already executed and exposed credentials.<\/p>\n\n\n\n Supply chain attacks demonstrate how a single compromised dependency can expose cloud infrastructure, developer environments, customer data, and production workloads.<\/p>\n\n\n\n At Astra Security, we recommend combining regular penetration testing<\/a>, dependency security reviews, and continuous vulnerability managemen<\/a>t<\/strong> to identify weaknesses before attackers can exploit them.<\/p>\n\n\n\n Regular penetration testing can help uncover excessive permissions, exposed secrets, weak network boundaries, vulnerable APIs, and gaps in incident detection. These weaknesses can turn a compromised dependency into a much larger security incident.<\/p>\n\n\n\n To reduce the blast radius of future compromises, organizations should also enforce least-privilege access, isolate CI\/CD environments, use short-lived credentials, maintain strong secret-management practices, and monitor unusual cloud API activity.<\/p>\n\n\n\n A compromised dependency should not automatically mean a compromised organization.<\/strong> Regular security testing and effective containment controls help limit what an attacker can access, how far they can move, and how much damage they can cause.<\/p>\n\n\n\n Astra helps organizations identify exploitable weaknesses through security assessments and penetration testing, strengthening their defenses against supply chain attacks and other emerging threats.<\/p>\n\n\n\n <\/p>\n","protected":false},"excerpt":{"rendered":" On October 21, 2026, a malicious version of LiteLLM (1.107.0) was published to PyPI. LiteLLM is a widely used open-source proxy that connects applications to more than 100 LLM providers. The compromised release contained an infostealer designed to exfiltrate credentials and a remote access trojan (RAT) capable of downloading and executing additional code. Stolen AWS … Read more<\/a><\/p>\n","protected":false},"author":138,"featured_media":49605,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[819],"tags":[],"class_list":["post-49602","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security-advisory"],"_links":{"self":[{"href":"https:\/\/www.getastra.com\/blog\/wp-json\/wp\/v2\/posts\/49602","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.getastra.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.getastra.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.getastra.com\/blog\/wp-json\/wp\/v2\/users\/138"}],"replies":[{"embeddable":true,"href":"https:\/\/www.getastra.com\/blog\/wp-json\/wp\/v2\/comments?post=49602"}],"version-history":[{"count":2,"href":"https:\/\/www.getastra.com\/blog\/wp-json\/wp\/v2\/posts\/49602\/revisions"}],"predecessor-version":[{"id":49613,"href":"https:\/\/www.getastra.com\/blog\/wp-json\/wp\/v2\/posts\/49602\/revisions\/49613"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.getastra.com\/blog\/wp-json\/wp\/v2\/media\/49605"}],"wp:attachment":[{"href":"https:\/\/www.getastra.com\/blog\/wp-json\/wp\/v2\/media?parent=49602"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.getastra.com\/blog\/wp-json\/wp\/v2\/categories?post=49602"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.getastra.com\/blog\/wp-json\/wp\/v2\/tags?post=49602"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}<\/span>How the LiteLLM Supply Chain Attack Happened<\/span><\/h2>\n\n\n\n
<\/span>What Data Was Stolen?<\/span><\/h2>\n\n\n\n
\n
<\/span>Post-Exploitation Activity<\/span><\/h2>\n\n\n\n
<\/span>Indicators of Compromise (IOCs)<\/span><\/h2>\n\n\n\n
\n
litellm==1.107.0<\/code><\/li>\n\n\n\nwww.litellm[.]dev<\/code><\/li>\n\n\n\nraw.githubusercontent[.]com\/letters9813\/pythonclient-test\/main\/domain.txt<\/code><\/li>\n\n\n\n:<\/strong> \/tmp\/remote_code_loader.lock<\/code><\/li>\n\n\n\n\/tmp\/.pc_once_72129118c59f5636c0bb<\/code><\/li>\n\n\n\n68.100.8[.]57, 165.227.201[.]8<\/code><\/li>\n\n\n\nPRIVCOLLECT_ACTIVE=1<\/code><\/li>\n<\/ul>\n\n\n\n<\/span>How to Respond to the LiteLLM Compromise<\/span><\/h2>\n\n\n\n
\n
sts:GetCallerIdentity<\/code>, bedrock:ListFoundationModels<\/code>, and IAM enumeration calls.<\/li>\n\n\n\n<\/span>How Astra Helps Reduce Supply Chain Risk<\/span><\/h2>\n\n\n\n
<\/span>Source<\/span><\/h2>\n\n\n\n
\n