LiteLLM Compromised: Supply Chain Attack Plants Credential Stealer and Backdoor in Popular AI Library

Users of LiteLLM, a widely adopted Python library that provides a unified interface for calling large language model APIs, are being urged to check their environments after security researchers uncovered a software supply chain compromise affecting version 1.107.0 of the package. According to reports from SafeDep, Socket, StepSecurity, and Upwind, the malicious release shipped a credential stealer and a backdoor to anyone who installed it from PyPI or pulled the corresponding Docker image.

The incident is a stark reminder that the AI tooling ecosystem, which is often deployed with broad access to API keys, cloud credentials, and internal services, has become an attractive target for attackers seeking a foothold in modern development pipelines.

What Happened

The compromise centered on LiteLLM 1.107.0, which was distributed through PyPI wheels and Docker images. Rather than exploiting a vulnerability in LiteLLM's own code, the attackers appear to have tampered with the release artifacts themselves, a hallmark of supply chain attacks that target the build and distribution process rather than the application logic.

Once installed, the malicious package reportedly delivered two distinct payloads: a credential stealer designed to harvest sensitive secrets from the host environment, and a backdoor intended to give the attacker persistent remote access. Because LiteLLM is typically configured with API keys for providers such as OpenAI, Anthropic, and others, along with access to internal services, a compromised installation could expose a significant amount of high-value material.

Python Package Index (PyPI) has since quarantined the affected package, limiting further downloads of the malicious version. The swift removal reduces ongoing exposure, but it does not help organizations that already installed the package before it was pulled.

Why LiteLLM Is a High-Value Target

LiteLLM has grown rapidly in popularity because it simplifies working with multiple LLM providers through a single, consistent interface. That convenience comes with concentrated risk: a single LiteLLM deployment often holds credentials for several AI providers, plus configuration data and network reachability into internal systems.

For attackers, this makes the library a force multiplier. A single compromised dependency can yield API keys that are billable and hard to rotate, access tokens for cloud platforms, and a persistent channel into environments where AI workloads run. The combination of a credential stealer and a backdoor is particularly dangerous because it enables both immediate data theft and long-term espionage.

Recommended Response

Organizations that may have installed or deployed the affected release should treat the incident as a potential breach rather than a routine dependency issue. Practical steps include:

  • Inventory exposure. Search lockfiles, container images, and build artifacts for LiteLLM 1.107.0 and any Docker images derived from it.
  • Rotate credentials. Assume any secrets accessible to a compromised installation may have been exfiltrated. Rotate LLM provider API keys, cloud credentials, and any tokens stored in environment variables or configuration files on affected hosts.
  • Hunt for persistence. Review affected systems for signs of the backdoor, including unexpected outbound connections, new scheduled tasks, modified startup scripts, and unusual processes.
  • Rebuild rather than patch. Where feasible, rebuild containers and virtual environments from known-good versions instead of attempting to clean an infected installation.
  • Pin and verify. Adopt dependency pinning with hash verification and monitor for unexpected version changes in critical packages.

The Broader Supply Chain Problem

The LiteLLM compromise fits a pattern that has accelerated over the past several years. Attackers have repeatedly targeted package registries and maintainer accounts, betting that developers will install updates automatically and that security teams have limited visibility into transitive dependencies.

The AI tooling boom adds a new dimension. Libraries like LiteLLM sit at the intersection of software development, cloud infrastructure, and sensitive API credentials, and they are often adopted quickly by teams eager to prototype. Speed of adoption frequently outpaces the maturity of supply chain controls around these packages.

Security teams should also consider that quarantine on PyPI is a mitigation, not a remediation. Malicious versions can persist in internal mirrors, cached build layers, and vendored copies. A thorough audit of artifact repositories and container registries is essential.

Key Takeaways

  • LiteLLM 1.107.0 was compromised and distributed via PyPI wheels and Docker images, delivering a credential stealer and backdoor.
  • PyPI has quarantined the package, but already-installed instances remain at risk.
  • Any environment that ran the affected version should be treated as potentially compromised, with credential rotation and threat hunting prioritized.
  • The incident underscores the need for stronger supply chain controls around AI and developer tooling.

For the full original reporting, see The Hacker News.