Unknown attackers compromised the release process of LiteLLM, the open source AI gateway built by BerriAI, and on Wednesday distributed a malicious version, 1.107.0, through PyPI and Docker registries. PyPI quarantined the release within hours and the Docker images were removed from Docker Hub and GHCR, but anyone who ran the compromised package should assume their secrets were stolen, security firms warned. The last safe version is 1.106.2.
The mechanics were designed for persistence. The payload came from malicious commits in a lookalike GitHub repository, Berri-AI with a hyphen, which fed three files into the release pipeline. One, cook.pth, makes Python run the second file, cook.py, every time the interpreter starts. That file is an infostealer with 16 modules targeting browsers, cloud providers and AI services: it harvests Chrome, Firefox, Edge and Safari credentials and cookies, AWS credentials and instance metadata, Google Cloud service account keys, Azure tokens, OpenAI, Anthropic and Cohere API keys, SSH and GPG keys and shell histories, encrypts the haul and posts it to an attacker controlled domain dressed up as a LiteLLM health check. The third file is a remote access trojan that spawns a daemon polling the attacker’s infrastructure every hour for new commands.
BerriAI later said the release actions were taken through three engineers’ GitHub accounts, apparently using stolen GitHub CLI OAuth tokens, with one account triggering the release run and another approving it. The exposure window was short because detection was fast: Socket’s scanner flagged all seven wheels seven minutes after publication, and unpinned installs between 11:39 and 13:23 UTC are the affected population.
This is the second LiteLLM compromise of 2026, after a March incident that CloudSEK estimated potentially exposed more than 2,500 organisations and 434,000 CI and CD pipelines. A gateway downloaded about 23 million times a week, whose whole purpose is to hold every provider key in one place, is now a demonstrated repeat target, and the defence that worked this time was automated scanning speed, not prevention.