LiteLLM PyPI Package and Docker Images Compromised to Steal Cloud and AI Credentials

A supply chain attack compromised the LiteLLM package version 1.107.0 on PyPI and associated Docker images, distributing a credential-stealing payload. The malicious package includes Python startup hooks (cook.pth, sitecustomize.py) that execute upon Python interpreter startup, even if LiteLLM is not imported, enabling theft of cloud credentials, AI provider keys, browser data, SSH keys, and other sensitive information. Data is exfiltrated to hxxp://www[.]litellm[.]dev/healthcheck in encrypted form, while a remote loader fetches and executes Python code from a GitHub-hosted domain pointer. The attack leveraged a lookalike GitHub repository (Berri-AI/litellm instead of BerriAI/litellm) in the build provenance, indicating a potential compromise in the release workflow.

AI-extracted · verify before operational use