LiteLLM 1.107.0 Wheels on PyPI Carried a Credential Stealer, AISLE Says; PyPI Quarantined the Release
Security vendor AISLE says all seven wheels of LiteLLM 1.107.0 published to PyPI on Oct. 21 contained malware that steals credentials and runs on every Python start, while the source distribution and GitHub tag were clean. PyPI quarantined the release, and a LiteLLM contributor says malicious Docker images have been removed. How the release was published has not been confirmed.
LiteLLM, which security vendor AISLE calls "the popular Python package," shipped malware through its built packages rather than its source code, according to AISLE, the sole source for the technical detail here. AISLE says all seven wheels of LiteLLM 1.107.0 published to PyPI on Wednesday, October 21 contained a credential stealer, while the source distribution and the signed v1.107.0 tag on GitHub did not. It says the first file was uploaded at 11:39:51 UTC and its dependency firewall flagged the first wheel at 11:43:05 UTC.
By AISLE's account, the malware runs every time Python starts on an affected machine, even if code never imports LiteLLM, and collects browser-saved passwords, SSH, GPG and TLS keys, cloud and Kubernetes credentials, CI/CD secrets and environment variables. AISLE says a second component runs in the background and checks hourly for further code to execute. AISLE says this points to a compromised build or publish step or a stolen PyPI publishing token, adding: "This is a breaking story; we have not yet confirmed which." AISLE credits Upwind with the first public report.
AISLE says PyPI quarantined the release; when we checked at about 15:00 UTC, PyPI's JSON API returned no 1.107.0 release and listed 1.106.2 as the latest version. On the project's GitHub issue tracker, a LiteLLM contributor account wrote at 13:50 UTC that the team was treating the incident as SEV-0, and at 14:32 UTC that "the malicious docker images have been removed," that the publishing method had not yet been identified or locked down, and that users should pin 1.106.2 for now. StepSecurity, a second security vendor, separately reported the same malicious wheels and said LiteLLM's official Docker images had carried the same payload before they were removed.
Limits
- The technical analysis is AISLE's, with a matching account from StepSecurity; both are security vendors, and we did not analyse the files ourselves.
- What we checked: PyPI's API returns no 1.107.0 release and lists 1.106.2 as latest, and the quarantine was confirmed on the issue tracker by a contributor account whose profile lists BerriAI.
- As of about 15:10 UTC, neither LiteLLM nor GitHub's advisory database had published an advisory for 1.107.0, and how the release was published was unconfirmed.