LiteLLM — Supply Chain Compromise in Release Pipeline Exposes Credentials and Deploys Remote Access Trojan

Publication date: October 22, 2026
Category: Cloud Security / Data Breach

Introduction

On October 21, 2026, the artificial intelligence and cloud security ecosystem experienced a severe supply chain incident when LiteLLM’s release infrastructure was compromised. Threat actors successfully bypassed multiple independent security controls to publish version v1.107.0 to the PyPI repository as well as the Docker Hub and GitHub Container Registry (GHCR) registries. The malicious payload integrated into these artifacts included an advanced credential stealer and remote access trojan (RAT) capabilities. The findings were initially investigated and reported by security firms including Aikido, Wiz, Socket, and JFrog, underscoring emerging supply chain attack vectors associated with AI-assisted development and cloud secret management.

What is LiteLLM? (General Analysis)

LiteLLM is an open-source gateway widely utilized to standardize and streamline calls to various large language models (LLMs) through a unified API interface. Acting as a critical middleware component in corporate infrastructures and development environments, it routinely handles sensitive credentials, AI provider API keys, and cloud service access tokens.

Because the software processes and caches high-value secrets, compromising its official packages instantly turns the gateway into an ideal beachhead for LLMjacking and lateral movement attacks.

  • Estimated CVSS Vector: CVSS v3.1 9.8 (Critical) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  • Estimated CWE Classification: CWE-506 (Embedded Malicious Code) / CWE-434 (Unrestricted Upload of File with Dangerous Type)
  • Note: As there are no official NVD records at the time of this analysis, the vector and severity represent a reasoned estimation based on the nature of remote code execution and large-scale secret exfiltration.

How Does It Work? (Technical Analysis)

The LiteLLM supply chain attack stood out for its highly sophisticated execution, leveraging unorthodox persistence mechanisms and code-loading techniques within the Python ecosystem.

  • Initial Infection Flow and .pth Vector: Users who downloaded unpinned versions of LiteLLM via pip or deployed the compromised Docker images unknowingly executed modified code. The package included a custom path file (cook.pth) configured to import a Python script named cook.py. This script deobfuscates itself at runtime and executes a routine called privcollect.
  • Credential Harvesting and Exfiltration: The privcollect routine sweeps the system for stored credentials, developer tokens, browser configurations, cloud service secrets, and AI tool tokens. Collected data is packaged and exfiltrated via an HTTP POST request directed to litellm[.]dev/healthcheck.
  • Unix Persistence via sitecustomize.py: On Linux and macOS operating systems, the Python interpreter natively processes sitecustomize.py. Attackers configured this script to query a dead-drop GitHub repository (github[.]com/letters9813) to retrieve a control text file (domain.txt). If a valid response is returned, the interpreter downloads a second-stage payload from <domain>/codepy.
  • Background Daemon and Command & Control (C2): The downloaded payload forks a background daemon that acquires an exclusive lock at /tmp/remote_code_loader.lock to prevent multiple concurrent instances. It then enters an infinite loop, periodically querying a GitHub URL (raw[.]githubusercontent.com/letters9813/pythonclient-test/main/domain[.]txt) to dynamically update its C2 domain and fetch subsequent Python payloads.
  • Exploitation and Subsequent LLMjacking: Wiz researchers documented that approximately 4.5 hours post-exfiltration, attackers began actively validating AWS instance role credentials captured from compromised CI runners and Kubernetes nodes. Utilizing commands such as sts:GetCallerIdentity followed by Bedrock model listing (bedrock:ListFoundationModels), the operators performed LLMjacking operations to hijack cloud compute resources.

Affected Systems / Environments

The incident specifically impacted versions and distribution channels published on October 21, 2026, between 11:39 a.m. and 2:20 p.m. UTC:

  • PyPI: Package litellm version v1.107.0.
  • Docker Hub and GHCR: Tags v1.107.0, latest, main-latest, and main-stable.
  • Risk Profile: Organizations utilizing unpinned dependencies in automated CI/CD deployment pipelines or deploying auto-updating container images during the affected time window.

Mitigation and Detection

Remediation

  1. Artifact Purging: Immediately remove LiteLLM version 1.107.0 from all development, testing, and production environments.
  2. Host Isolation: Isolate any servers or CI/CD runner nodes where the compromised version executed during the incident window.
  3. Mass Credential Rotation: Assume full compromise and immediately rotate all API keys, AWS tokens, AI provider credentials, GitHub tokens, and infrastructure secrets accessible from the impacted environments.
  4. Pipeline Hardening: Maintain release repositories in private mode, enforce immutable Docker tags, and mandate cryptographic image signing.

Detection

Defensive teams (Blue Team) should perform proactive hunting for the following Indicators of Compromise (IoCs) and artifacts:

  • Presence of cook.pth, cook.py, or sitecustomize.py files containing external download logic within Python site-packages or working directories.
  • Existence of the lock file /tmp/remote_code_loader.lock.
  • Outbound HTTP requests targeting litellm[.]dev/healthcheck or dynamic domains fetched from raw.githubusercontent.com/letters9813/.
  • Anomalous AWS CloudTrail logs displaying repeated sts:GetCallerIdentity calls coupled with bedrock:ListFoundationModels.

“A single compromised install can hand an attacker the ability to push malicious code downstream. The lesson for security teams is that a clean source repository tells you little about the artifact you actually install.”

Wrapping Up

The LiteLLM incident highlights the critical vulnerability inherent in modern software supply chains and the risks associated with improper credential management in AI-assisted development environments. The accidental exposure of GitHub CLI tokens through internal deployment logs enabled threat actors to hijack legitimate workflows and distribute a sophisticated RAT capable of executing LLMjacking. Organizations must adopt rigorous dependency validation (wheel vetting), registry immutability, and automated secret rotation practices to mitigate similar threats.

References