LiteLLM supply chain attack compromises AI developer credentials

The LiteLLM project, a widely used open-source Python SDK and AI gateway, has been targeted in a sophisticated software supply chain attack. Hackers compromised the project’s release pipeline to distribute malicious versions of the software via PyPI and Docker registries.

Security researchers and LiteLLM maintainers confirmed that version 1.107.0 was affected. The attack involved the distribution of compiled malware designed to steal credentials, secrets, and environment variables, while also loading remote-code execution tools. The compromise impacted Windows, Linux, and macOS systems through all seven PyPI wheels for that version.

The breach was facilitated by stolen GitHub CLI OAuth tokens belonging to three LiteLLM engineers. According to security director Oliver Jensen, the threat actor used one account to trigger a project-releaser run and another to approve it. While the malicious packages have since been quarantined or removed, the exact mechanism used to acquire the tokens remains under investigation. LiteLLM, which is used by major companies including NVIDIA and Netflix, stated that customers using their private enterprise version were not impacted.