{"slug": "litellm-supply-chain-attack-v1-107-0-iocs-and-response-steps", "title": "LiteLLM Supply Chain Attack: v1.107.0 IOCs and Response Steps", "summary": "A malicious version of the open-source LiteLLM proxy, 1.107.0, was published to PyPI on October 21, 2026, carrying an infostealer and a remote access trojan, and stolen AWS credentials were reportedly abused within hours of exfiltration. The attacker compromised three engineers' GitHub accounts using stolen GitHub CLI OAuth tokens via the lookalike repository Berri-AI/litellm to push the release to PyPI and Docker registries; the package has been quarantined, compromised Docker tags removed, and the latest reported safe version is 1.106.2. Organizations that installed or executed 1.107.0 should pin LiteLLM to 1.106.2 and rotate cloud keys, LLM API keys, GitHub tokens, SSH keys and database credentials, with suspicious AWS activity traced to 168.100.8[.]57 and 165.227.201[.]8 including Amazon Bedrock model enumeration and IAM discovery.", "body_md": "On October 21, 2026, a malicious version of LiteLLM (1.107.0) was published to PyPI. LiteLLM is a widely used open-source proxy that connects applications to more than 100 LLM providers.\n\nThe compromised release contained an infostealer designed to exfiltrate credentials and a remote access trojan (RAT) capable of downloading and executing additional code. Stolen AWS credentials were reportedly abused within hours of the initial exfiltration.\n\nThe malicious PyPI package was quarantined, and compromised Docker tags were removed. **The latest reported safe version is** **1.106.2****.**\n\nOrganizations that installed or executed the compromised release should treat affected systems as potentially compromised and begin incident response immediately.\n\n## How the LiteLLM Supply Chain Attack Happened\n\nThe attack originated from a lookalike GitHub repository, Berri-AI/litellm, which was used to introduce malicious files and modify the release pipeline.\n\nThe attacker reportedly compromised three engineers’ GitHub accounts using stolen GitHub CLI OAuth tokens. These accounts were used to trigger and approve a release, allowing the malicious version to reach PyPI and Docker registries.\n\nChanges to pyproject.toml and Dockerfiles helped package and execute the malicious payload. The LiteLLM team subsequently revoked the compromised tokens.\n\n## What Data Was Stolen?\n\nThe infostealer targeted a broad range of sensitive information, including:\n\n- **Cloud credentials:** AWS, GCP, and Azure tokens and keys.\n- **AI provider secrets:** API keys for OpenAI, Anthropic, Cohere, and other LLM services.\n- **Developer credentials:** GitHub tokens, SSH and GPG keys, package manager credentials, and developer tool secrets.\n- **Browser data:** Saved passwords, cookies, and browsing history.\n- **Infrastructure secrets:** Kubernetes tokens, Docker credentials, CI/CD secrets, and Vault tokens.\n- **LiteLLM database records:** Configured provider credentials and proxy model information.\n\nThe stolen data was encrypted before being exfiltrated to www.litellm[.]dev/healthcheck, a lookalike domain impersonating LiteLLM infrastructure.\n\n## Post-Exploitation Activity\n\nA separate payload, delivered through sitecustomize.py, attempted to contact a GitHub-hosted dead-drop repository every hour. If supplied with a usable command-and-control domain, it could retrieve and execute additional Python code.\n\nAlthough no second-stage payload was observed during the initial analysis, the capability remained on infected systems.\n\nThe incident also progressed beyond credential theft. On October 21, suspicious AWS activity was observed from 168.100.8[.]57 and 165.227.201[.]8, including credential validation, Amazon Bedrock model enumeration, and IAM discovery. These activities are consistent with attempts to abuse stolen cloud credentials for unauthorized LLM usage and further reconnaissance.\n\n## Indicators of Compromise (IOCs)\n\nSecurity teams should investigate the following indicators alongside their endpoint, network, and cloud audit logs:\n\n- **Malicious package:** `litellm==1.107.0`\n- **Suspicious domain:**`www.litellm[.]dev`\n- **RAT dead-drop URL:**`raw.githubusercontent[.]com/letters9813/pythonclient-test/main/domain.txt`\n- **Persistence lock file****:** /tmp/remote_code_loader.lock\n- **Stealer sentinel file:**`/tmp/.pc_once_72129118c59f5636c0bb`\n- **Suspicious source IPs:** 1`68.100.8[.]57, 165.227.201[.]8`\n- **Environment variable:**`PRIVCOLLECT_ACTIVE=1`\n\nThese indicators may change or become inactive. Their absence does not prove that a system is clean.\n\n## How to Respond to the LiteLLM Compromise\n\nOrganizations that installed or executed the malicious release should:\n\n1. **Upgrade to a verified safe version:** Pin LiteLLM to 1.106.2 or another release explicitly confirmed safe by the maintainers.\n2. **Rotate exposed credentials:** Replace cloud keys, LLM API keys, GitHub tokens, SSH keys, database credentials, and other secrets accessible to affected hosts.\n3. **Investigate cloud activity:** Review AWS CloudTrail for unexpected`sts:GetCallerIdentity` ,`bedrock:ListFoundationModels` , and IAM enumeration calls.\n4. **Contain affected systems:** Isolate compromised hosts and rebuild them from trusted images rather than relying solely on deleting malicious files.\n5. **Inspect CI/CD pipelines:** Review GitHub audit logs, release approvals, OAuth token usage, and container image provenance.\n6. **Check downstream deployments:** Identify affected containers, Kubernetes workloads, developer machines, and CI runners.\n\nSimply upgrading the package is not sufficient if the malicious code has already executed and exposed credentials.\n\n## How Astra Helps Reduce Supply Chain Risk\n\nSupply chain attacks demonstrate how a single compromised dependency can expose cloud infrastructure, developer environments, customer data, and production workloads.\n\nAt Astra Security, we recommend combining **regular [penetration testing](https://www.getastra.com/pentest), dependency security reviews, and continuous [vulnerability managemen](https://www.getastra.com/blog/security-audit/continuous-vulnerability-management/)t** to identify weaknesses before attackers can exploit them.\n\nRegular penetration testing can help uncover excessive permissions, exposed secrets, weak network boundaries, vulnerable APIs, and gaps in incident detection. These weaknesses can turn a compromised dependency into a much larger security incident.\n\nTo reduce the blast radius of future compromises, organizations should also enforce least-privilege access, isolate CI/CD environments, use short-lived credentials, maintain strong secret-management practices, and monitor unusual cloud API activity.\n\n**A compromised dependency should not automatically mean a compromised organization.** Regular security testing and effective containment controls help limit what an attacker can access, how far they can move, and how much damage they can cause.\n\nAstra helps organizations identify exploitable weaknesses through security assessments and penetration testing, strengthening their defenses against supply chain attacks and other emerging threats.", "url": "https://wpnews.pro/news/litellm-supply-chain-attack-v1-107-0-iocs-and-response-steps", "canonical_source": "https://www.getastra.com/blog/security-advisory/litellm-supply-chain-attack/", "published_at": "2026-10-22 10:38:42+00:00", "updated_at": "2026-10-22 13:40:50.540307+00:00", "lang": "en", "topics": ["ai-safety", "ai-infrastructure", "ai-tools", "developer-tools"], "entities": ["LiteLLM", "PyPI", "GitHub", "Berri-AI/litellm", "Amazon Web Services", "Amazon Bedrock", "OpenAI", "Anthropic"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/litellm-supply-chain-attack-v1-107-0-iocs-and-response-steps", "markdown": "https://wpnews.pro/news/litellm-supply-chain-attack-v1-107-0-iocs-and-response-steps.md", "text": "https://wpnews.pro/news/litellm-supply-chain-attack-v1-107-0-iocs-and-response-steps.txt", "jsonld": "https://wpnews.pro/news/litellm-supply-chain-attack-v1-107-0-iocs-and-response-steps.jsonld"}}