LiteLLM Release Pipeline Hijacked to Ship Backdoored v1.107.0 With Credential Stealer, Report Finds
A The Hacker News investigation says attackers broke into LiteLLM’s release process and pushed a malicious v1.107.0 package that included a credential stealer and backdoor code, later testing stolen AWS cloud keys.
A routine update for LiteLLM, an open‑source tool used to work with large language models, has turned into a warning sign for the wider AI software stack. According to reporting by The Hacker News, attackers compromised the project’s release pipeline and used it to distribute a tainted version of the package.
The report says LiteLLM’s v1.107.0 release was malicious. Users who installed it brought in code designed both to steal credentials and to provide a hidden backdoor. The project’s maintainers believe the attackers got hold of GitHub OAuth tokens from logs on an exposed internal LiteLLM deployment and then used those tokens to interfere with the release process.
Investigators cited by The Hacker News say the rogue package contained a credential stealer focused on cloud environments, including Amazon Web Services (AWS). The attackers are reported to have successfully collected AWS keys from some users and later tried to test and use those credentials.
For organizations that integrated LiteLLM into production systems, this means a trusted dependency briefly became an entry point for spying inside their own infrastructure. Any cloud keys the malware pulled from environment variables or configuration files could let intruders read or alter data, create new cloud resources or move deeper into internal networks.
The incident highlights how quickly a compromise in the AI tooling ecosystem can escalate into broader security problems. Many companies now rely on small, fast‑moving open‑source projects to connect applications to language models and other AI services. When an attacker gains control of a project’s release pipeline, a malicious update can reach a large number of environments before anyone notices.
The suspected theft of GitHub OAuth tokens from exposed internal logs also shows how vulnerable development plumbing can be. Systems used for testing, logging and continuous deployment often hold powerful credentials but don’t always receive the same level of protection as public‑facing services.
Security teams will be looking for clear technical details: a breakdown of v1.107.0’s malicious behavior, network indicators linked to data exfiltration, and guidance on detecting whether their own LiteLLM deployments ran the compromised code. Cloud providers like AWS will face questions about any unusual account activity tied to keys known or suspected to have been stolen.
Whether this remains a single high‑profile incident or signals a broader campaign against AI‑related projects will depend on what researchers find next in neighboring tools and libraries that sit close to language models and cloud APIs.
Sources
- OSINT