Software supply chain defenses suffered another severe blow when attackers compromised the release mechanisms of LiteLLM, one of the most widely deployed open-source AI proxy and gateway solutions in enterprise engineering. Utilized by thousands of tech companies and Fortune 500 engineering departments across the US and Canada to manage, route, and load-balance calls across large language models, LiteLLM’s compromised packages exposed production secrets, backend cloud keys, and API tokens across the software development lifecycle. The incident marks the second major supply-chain hit on LiteLLM in seven months, demonstrating how attackers are aggressively zeroing in on the generative AI infrastructure stack.

The compromise occurred when malicious threat actors published poisoned versions of LiteLLM (version 1.107.0) directly to the Python Package Index (PyPI) and official Docker image registries. While the official Git repository’s raw source code remained clean, the attackers had infiltrated the release pipeline using stolen GitHub CLI OAuth developer tokens. Forensic reports indicate that these tokens were inadvertently exposed via developer logs or environment misconfigurations during local AI tool usage. Once armed with elevated developer privileges, the intruders bypassed branch protection controls, established lookalike staging builds, and deployed seven backdoored Python wheels that carried an obfuscated payload.

The malicious payload inside the wheel packages was uniquely pernicious. It abused Python startup mechanisms via .pth files and custom site definitions, meaning the malicious code executed immediately whenever Python booted up—even if the underlying application never formally called or imported the litellm library. The payload operated as a dual-stage threat: it functioned as a silent credential harvester, sweeping local host files for SSH keys, cloud infrastructure secrets (AWS, Azure, GCP), browser credentials, and enterprise LLM provider keys stored in LiteLLM proxy databases. Simultaneously, it established an hourly remote code execution loop linking back to a command dead-drop.

Within hours of the malicious release, cybersecurity analysts observed attackers leveraging stolen AWS credentials to spin up unauthorized Amazon Bedrock instances—a clear pattern of “LLMjacking” intended to siphon expensive AI computing resources and models on enterprise corporate accounts. The tainted artifacts remained accessible on public registries for approximately 100 minutes before PyPI and Docker Hub quarantined the build.

This attack is an urgent wake-up call for North American engineering teams. Modern AI developer platforms cannot be treated with lower scrutiny than core database or networking layers. Companies are advised to immediately inspect requirements lockfiles, wipe environments running version 1.107.0, purge unauthorized startup files, and revoke all API and cloud infrastructure keys associated with affected developer endpoints. Furthermore, engineering teams must transition to verifiable build architectures that compile dependencies strictly from vetted source code rather than blindly consuming prebuilt binaries from public package hubs.