LiteLLM Suspects GitHub Token Leak in AI Gateway Logs Behind Malicious Package Release
LiteLLM disclosed a security incident where threat actors compromised its release pipeline, pushing a malicious version of its Python package containing a credential stealer and backdoor.
Intelligence analysis by Gemini 2.5 Flash Lite
A malicious version of the LiteLLM Python package was pushed to Docker Hub and PyPI, containing code to steal credentials and act as a remote access trojan. The attackers likely exploited leaked GitHub CLI OAuth tokens from LiteLLM's logs to compromise the release pipeline.
Imagine a popular building block set for computers called LiteLLM. Someone sneaky found a way to sneak a bad version of the blocks into the official store. This bad version had secret instructions to steal your computer's passwords and let the sneaky person control your computer from far away. They likely got the secret key to do this by looking at some notes LiteLLM accidentally left out.
Analysis
GitHub Token Leak
The core of this security incident appears to stem from a compromise of developer credentials, specifically GitHub CLI OAuth tokens. LiteLLM's investigation suggests that these tokens, potentially embedded in logs due to an issue with Claude Code, were accessed by an attacker. This access allowed the threat actor to disable branch protections and force-push malicious changes into the LiteLLM release pipeline. The attacker leveraged a token belonging to one of the organization's owners, which had the capability to run GitHub workflows. This enabled them to execute a compromised workflow that pointed to a lookalike repository, "Berri-AI/litellm," instead of the legitimate "BerriAI/litellm," leading to the signing and publication of poisoned artifacts.
Malicious Package Functionality
The compromised LiteLLM versions, specifically v1.107.0 on PyPI and corresponding Docker images, contained sophisticated malicious code. Upon installation, the package would process a "cook.pth" file, which in turn imported "cook.py." This script would deobfuscate itself and execute a routine named "privcollect" designed to steal various secrets, including system, browser, developer, cloud, and AI tool credentials. The stolen data was then exfiltrated via HTTP POST requests to "litellm[.]dev/healthcheck." Furthermore, a "sitecustomize.py" script, active on Linux and macOS, attempted to download and execute a second-stage payload from a GitHub repository. This payload established a remote access trojan (RAT) that fetched updated commands from a C2 server every hour.
Supply Chain and Mitigation Efforts
This incident is particularly concerning due to its impact on the AI development supply chain. The use of a "cook.pth" file to launch the stealer mirrors tactics seen in a previous March 2026 attack, though direct attribution is not yet established. LiteLLM had previously implemented security enhancements after an earlier incident, including moving releases to a private repository and signing Docker images. However, the temporary expansion of release permissions for two internal engineers to publish bugfix backports created an opening. The attacker exploited this by gaining access to an internal LiteLLM deployment, suspected to be through a recently patched vulnerability, which exposed GitHub CLI OAuth tokens in its logs. The compromised credentials were then used to bypass security controls and inject malicious code into the legitimate package distribution channels.
Key points
- LiteLLM's release pipeline was compromised, leading to the distribution of malicious versions of its Python package.
- The poisoned package contained a credential stealer and a backdoor, exfiltrating sensitive data and enabling remote code execution.
- Attackers likely exploited leaked GitHub CLI OAuth tokens from LiteLLM's logs to gain unauthorized access.
- The incident underscores the security risks inherent in software supply chains, particularly within the AI development ecosystem.
- LiteLLM has implemented further security measures and is investigating the root cause of the credential leak.
LiteLLM has already taken steps to harden its release pipeline following this incident, including moving releases to private repositories and signing Docker images. The swift identification and disclosure of the compromise by LiteLLM, along with the subsequent investigation by security researchers, will contribute to improved security practices across the AI development ecosystem.
The compromise highlights a significant vulnerability in the AI supply chain, where even established projects can be infiltrated. The potential for widespread distribution of malicious code through popular packages poses a continuous threat, and the exact method of initial access to LiteLLM's internal deployment remains unclear, suggesting other unknown vulnerabilities might exist.
