Overview
LiteLLM, an open-source tool widely used by AI developers, says a key accidentally exposed in May was behind a supply-chain attack last week. A configuration file containing the master key for an internal tool used to run AI agents was published; LiteLLM removed the file but did not revoke the key.
Attack Chain
- Earlier this month, an unidentified attacker used the key to access LiteLLM's tooling and obtain a token controlling all of its GitHub repositories.
- Using that access, the attacker published LiteLLM 1.107.0 to PyPI containing credential-harvesting malware.
- The package was live for about two hours, with roughly 49,000 downloads according to Wiz.
Malware Behavior
Per Microsoft, the malware runs whenever Python starts on an infected machine, even if the program never imports LiteLLM. It includes a credential stealer and a backdoor that polls hourly. Within about 4.5 hours of upload, the attacker was testing stolen AWS credentials to see which Amazon AI models the accounts could reach, which Wiz says matches "LLMjacking".
Background
This is LiteLLM's second supply-chain compromise this year; in March, malicious versions were published in a campaign linked to the TeamPCP group. No affected organization has publicly confirmed a breach.
Recommendations
- Check for LiteLLM 1.107.0 in all environments, CI caches, and container images.
- If installed on an internet-connected machine, assume credentials were stolen and rotate every password, token, and access key it could reach.
- Review AWS CloudTrail for Bedrock model-access probing.
- Always revoke exposed secrets immediately; deleting the file is not enough.