# LiteLLM supply chain attack hoovers up passwords and secrets — retained record > Retained news record from news:theregister. Canonical: https://highsignal.app/data/records/b88c7616d41101c1 [← sources](https://highsignal.app/data) source: [news](https://highsignal.app/data/news) (news:theregister) published 2026-10-21 18:22 ingested 2026-10-22 02:59 [original source ↗](https://www.theregister.com/security/2026/10/21/litellm-supply-chain-attack-hoovers-up-passwords-and-secrets/5304548) ## extract AI - Nvidia woos wary Europeans with more open weights models New embedding, parsing, and reranking models promise smarter agentic RAG workflows - Jensen Huang sends in the robot ducks to sell Nvidia's AI-everywhere vision Containerized datacenters, androids, and telecoms all feature in Berlin keynote interrupted by environmental protesters - Nvidia's grand plan for speeding up datacenter deployments: AI trailer parks GPUzilla boasts modular bit barns could speed up deployments from six months to just two weeks - The spec is the new code, so brush up on your prose, says Kaseya CTO Domain expertise and clear writing will matter more than syntax, and yes, that means documentation - Happiness is the next AI KPI if Oxford boffins have their way Researchers say public subsidies for AI should be repaid in wellbeing, not just economic growth Infosec - Security Russians are posing as Signal support to launch phishing attacks PLUS: US takes down Iranian propaganda sites; Marketing company asks 'Why Do We Have Your Information?' And more! - Security Microsoft patches failed to fix on-prem SharePoint, which is now under zero-day attack PLUS: China upgrades smartphone surveillance tools; Ring eases anti-snooping stance; and more - Black Hat and DEF CON DEF CON Franklin project enlists hackers to harden critical infrastructure Voting village reports have been so successful, says Jeff Moss, that the whole of DEF CON will now be included - Security EQT buys majority share in Swiss cybersecurity biz Acronis Went at equivalent of $3.5B+ valuation for entire firm, though portion sold not specified - Malware Month Ten years since the first corp ransomware, Mikko Hyppönen sees no end in sight On the plus side, infosec's a good bet for a long, stable career FOSS - Red Hat helps teach about tech writing But learns tough lessons about AI in the process - NetBSD may have found a new role: The AI-free FOSS OS Increasing awareness and adoption, followed by increasing donations - OpenAI dots inspire open source imitators amid technical difficulties Persistent agents appeal to AI companies, but demand isn't obvious - Ubuntu 'Stonking Stingray' beta swims out: Deeper Rust 'oxidization' plus LLM speech-to-text GNOME 51 is here, and Ubuntu interim releases are getting interesting again - Revive Raskin's 3 laws of software with humane work that considers a dev's duty of care All this, and angry NeoVim users - Firefox 157: Could bold new look be just what Mozilla needs?* Yet another new version of Firefox, with a significant reskin ## retained text ``` Unknown crims compromised LiteLLM's release process on Wednesday, distributing a malicious version (1.107.0) containing malware designed to steal cloud and AI credentials and a remote access trojan (RAT) capable of executing arbitrary code on infected machines through PyPI and Docker registries. PyPI quarantined the trojanized version of the popular open source AI gateway within hours, and the Docker image (litellm/litellm:1.107.0) was removed from both Docker Hub and GHCR soon after - but anyone who ran the compromised package on any platform should assume their secrets have been stolen. “Check for /tmp/.pc_once_* (the exfil has already fired if this file exists) and /tmp/remote_code_loader.lock (the C2 daemon ran or is still running if this file exists),” advised Aikido Security malware hunter Ilyas Makari. “The same applies to anyone who ran the official Docker image litellm/litellm:1.107.0, or pulled it via the latest, main-latest, or main-stable tags.” REG AD The most recent safe version is v1.106.2. REG AD While it’s too early to tell the scale of this latest LiteLLM supply chain attack – an earlier LiteLLM compromise in March potentially exposed more than 2,500 organizations and 434,000 CI/CD pipelines worldwide, according to CloudSEK – make sure to take these measures seriously, and check environments for any indicators of compromise. Aikido, Google’s Wiz cloud security biz, and supply-chain security provider Socket have all published extensive threat-hunting and mitigation instructions for LiteLLM users and security teams, so give those a read stat. LiteLLM, developed by BerriAI, provides a common interface for LLM providers, including OpenAI, Anthropic, and Google Gemini, and receives about 23 million weekly downloads. This means a compromised installation can run alongside LLM provider API keys, cloud identities, and database connection strings - and expose a ton of valuable credentials, secrets, and other sensitive data to whoever uploaded the malicious package. “Teams using 1.107.0 should stop deploying it and investigate environments where Python ran after installation, including proxy containers and CI runners,” Socket researchers said on Wednesday. The malicious version was uploaded at 11:39 UTC, and according to Wiz kids Benjamin Read and Rami McCarthy, the payload originates with malicious commits made on github.com/Berri-AI/litellm, which is a hyphenated variant of the legitimate BerriAI organization. Miscreants used this repo to inject the three malicious files into the LiteLLM release pipeline. These, according to Makari, include cook.pth, which causes the second file, cook.py, to run automatically every time Python is invoked on the machine, without any additional user action. Meanwhile, cook.py contains the infostealer, and the third file, sitecustomize.py, is the RAT. Python also executes the RAT at interpreter startup, and this file spawns a background daemon that polls the attacker's infrastructure every hour for new commands to execute. Upon executing, the infostealer harvests a ton of sensitive data across 16 modules targeting browsers, cloud providers, and AI services, according to Read and McCarthy. REG AD It steals browser credentials and cookies from Chrome, Firefox, Edge, and Safari, along with AWS credentials from ~/.aws/, environment variables, and EC2/ECS instance metadata (IMDS). It also collects users’ Google Cloud Platform service account keys and application default credentials, along with Microsoft Azure tokens from the CLI cache. And then it also swipes API keys for OpenAI, Anthropic, Cohere, and other LLM providers, plus SSH private keys, GPG keys, and shell history files. The malware then encrypts all of this stolen data using AES-256-CBC, wraps the encryption key with an RSA-4096 public key, and sends the encrypted data via HTTP POST to an attacker-controlled domain: http://www[.]litellm[.]dev/healthcheck. BerriAI did not respond to The Register’s inquiries. This is an emerging story, and we will continue to update it as we learn more details.® ``` document fetched 2026-10-24 11:21 · canonical https://theregister.com/security/2026/10/21/litellm-supply-chain-attack-hoovers-up-passwords-and-secrets/5304548