Malware in LiteLLM 1.107.0 steals cloud and AI keys

Unknown attackers changed the release pipeline of LiteLLM, an open source AI gateway from BerriAI, on Wednesday. They put version 1.107.0 on PyPI, the Python package registry, and on Docker registries. It holds malware that steals cloud and AI credentials. It also holds a remote access trojan, a tool that lets attackers operate code on a machine. LiteLLM gets about 23 million downloads each week.

How it works

Wiz researchers say that the attackers added three bad files to the pipeline. They used a repository with a name almost the same as the name of BerriAI. One file makes a second file start each time Python starts. The third file is the trojan. It asks the attacker for new commands each hour.

The numbers

The theft code has 16 modules. It takes these items and sends them out in encrypted code:

• passwords and cookies from a browser
• Google Cloud, AWS and Azure credentials
• keys for OpenAI, Anthropic and Cohere
• SSH keys and shell history

PyPI quarantined the version in hours. Docker Hub removed the image.

What is not known

The scale is not known at this time. BerriAI did not give an answer. Socket researchers say that teams must stop use of 1.107.0 and look at proxy containers and pipeline runners.

Insight: A gateway is a good target because it holds many keys

LiteLLM sits between software and model providers. In March 2026, an earlier compromise possibly exposed more than 2,500 organizations, CloudSEK says. Bitsight reports a tool that runs on stolen AI keys while the owner pays. This seems to show that attackers point at the gateway, because one hit gives keys for many providers. Your gateway is your most valuable storage of secrets.