LiteLLM Suspects GitHub Token Leak in AI Gateway Logs Behind Malicious Package Release
Summary: LiteLLM disclosed that attackers compromised its release pipeline and published malicious version 1.107.0 to Docker Hub and PyPI around 4:00 a.m. PST on October 21, 2026, after obtaining GitHub CLI OAuth tokens from logs of a publicly exposed internal deployment. The poisoned package added cook.pth, cook.py, and sitecustomize.py to run a credential stealer called privcollect and a daemon that fetched and executed a remote payload hourly from a GitHub dead drop. Wiz observed stolen AWS instance role credentials validated via sts:GetCallerIdentity and bedrock:ListFoundationModels between 4:20 p.m. and 5:01 p.m. UTC, consistent with LLMjacking.
Why it matters: Wiz saw stolen CI and Kubernetes credentials put to use roughly 4.5 hours after exfiltration, so any environment that installed 1.107.0 should treat every reachable secret as already compromised. The payload fires on any Python launch in that environment, whether or not the application uses LiteLLM.
Read the original at The Hacker News ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026