49,000 Downloads of a Poisoned LiteLLM Package in About Three Hours
Attackers hijacked three developers' GitHub accounts to push a credential-stealing version of the popular AI routing tool. Version 1.106.2 is the last clean release.
Key points - Malicious LiteLLM version 1.107.0 was live on PyPI on October 21 for roughly three hours before the package was quarantined and Docker images were removed. - According to ClickPy download data cited by Wiz, the poisoned package received approximately 49,000 downloads before removal. - Attackers used stolen GitHub CLI OAuth tokens, a type of digital key that lets command-line tools act on a developer's behalf, to bypass publishing controls. - The malware harvested cloud credentials for AWS and Google Cloud alongside AI API keys for services including OpenAI and Anthropic, then sent them to a domain called litellm[.]dev. - Anyone who installed 1.107.0 should remove it immediately and rotate every credential on that machine.
Somewhere between a Tuesday morning coffee and lunch, a widely used piece of AI software turned into a trap. That's the short version of what happened to LiteLLM, an open-source tool that companies use to route requests between different large-language-model services such as OpenAI's GPT models or Anthropic's Claude. We've followed LiteLLM's security record closely: our initial report on this same hijack ran on 22 October, the day after the incident.
What actually happened?
On October 21, attackers uploaded version 1.107.0 of LiteLLM to PyPI, the central online registry where Python developers download software packages. The version looked legitimate. It wasn't.
According to Wiz's investigation, the attackers had obtained GitHub CLI OAuth tokens belonging to three engineers on the LiteLLM project. One compromised account triggered the automated release process; a second approved it, bypassing the checks meant to stop unauthorised changes. Branch protections, the settings that prevent unreviewed code from going live, were disabled. A workflow was quietly redirected to pull code from a lookalike repository, not the real one. The result was a signed, published package carrying hidden malware.
Docker containers, pre-packaged software environments that companies deploy on their own servers, were also affected. Tags including latest and main-stable on both GitHub Container Registry and Docker Hub pointed to the trojanised image before those were removed or repointed to clean builds.
| Event | Time (UTC, Oct 21) |
|---|---|
| Credential abuse observed (per Wiz) | approx. 16:09 (roughly 4.5 hrs after exfiltration) |
How did the tokens get stolen?
LiteLLM's own post-incident review points to Claude Code, an AI coding assistant. In certain circumstances, Claude Code would embed GitHub CLI OAuth tokens into its response text, which LiteLLM's logging system then recorded. An attacker who had reached the internal LiteLLM deployment could have read those logs and harvested the tokens. How the attacker first accessed that internal system is still not fully established. All tokens involved have since been revoked.
What did the malware do to infected machines?
Three files were dropped into Python's core directory so they ran automatically whenever any Python script started. One was a credential stealer: it swept the machine for browser passwords, SSH private keys (the digital certificates used to log into remote servers), shell history, environment variables (settings files that often contain passwords), and cloud secrets for AWS and Google Cloud. It also grabbed AI service API keys for tools including OpenAI and GitHub Copilot, plus GPG keys. Everything collected was encrypted and sent to litellm[.]dev.
The second component was a RAT, short for remote access trojan, software that gives criminals ongoing remote control of a machine. It maintained contact with a command-and-control server and checked a GitHub-hosted location every hour to fetch and run fresh instructions.
Wiz observed the attackers using stolen AWS credentials to query Amazon Bedrock AI models roughly four and a half hours after the theft, a pattern known as LLMjacking where criminals use victims' cloud accounts to run AI queries at the victim's expense. We covered the broader shift toward this kind of AI-infrastructure targeting in our September piece on nation-state and criminal LLMjacking.
LiteLLM says its enterprise customers pulling from a private repository were not affected.
What should people who use LiteLLM do?
If you or your organisation installed LiteLLM on October 21 during the compromise window, assume version 1.107.0 reached your system. Remove it, upgrade to 1.106.2 or later, then rotate every credential accessible from that machine. Check your cloud provider's billing for unusual AI usage charges: that's the clearest early signal of LLMjacking.
The honest read: supply chain attacks against developer tools are becoming the preferred route into AI infrastructure, because credentials on a developer's laptop often open cloud environments worth far more. The attack window here was short; 49,000 downloads shows how little that matters.
