LiteLLM's Poisoned Pipeline: How Attackers Weaponized an AI Gateway to Steal Cloud and Developer Secrets
Executive Summary
On October 21, 2026, attackers compromised the LiteLLM project's release pipeline and published malicious version 1.107.0 to PyPI and Docker Hub. The tampered package contained an info-stealer that harvested cloud credentials (AWS, Azure, GCP, Kubernetes), AI provider secrets, developer keys, browser data, and environment variables, encrypting the haul with AES-256-CBC under an RSA-4096 key before exfiltrating it to a threat-actor-controlled endpoint. All seven PyPI wheels and four Docker image tags were affected for roughly two hours before removal. Organizations running LiteLLM in production—including high-profile users such as NVIDIA, Netflix, AT&T, and Okta—were at risk of full secrets compromise across their AI infrastructure.
This incident is the second supply-chain attack against LiteLLM within a single year, following the March 2026 TeamPCP campaign. It illustrates a rapidly maturing attacker playbook that targets AI gateway libraries to achieve broad, simultaneous credential theft across cloud, DevOps, and AI toolchains—a pattern that is accelerating as AI-integrated software becomes ubiquitous in enterprise environments.
Why This Matters Now
AI SDK supply-chain attacks are surging in 2026 as threat actors recognize that a single poisoned package in an AI gateway can yield cloud, CI/CD, and model-provider credentials at scale. With over 92 million monthly PyPI downloads, LiteLLM's compromise demonstrates that even widely trusted open-source AI infrastructure is a high-value, under-defended target—and that credential exfiltration from developer environments can propagate silently before detection.
Attack Path Analysis
Attackers compromised LiteLLM's release pipeline, injecting malicious Python startup hook files into the PyPI package for version 1.107.0 and pushing poisoned Docker images to Docker Hub and GHCR. The malware executed automatically on every Python invocation, harvested a wide array of credentials and secrets from cloud, AI, developer, and browser contexts, encrypted the stolen data with AES-256-CBC/RSA-4096, and exfiltrated it to an attacker-controlled endpoint while establishing an hourly C2 polling loop for persistent remote code execution.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
The attacker compromised LiteLLM's CI/CD release pipeline, gaining write access to PyPI and the Docker registries. They injected three malicious Python startup hook files (cook.pth, cook.py, sitecustomize.py) into the litellm==1.107.0 wheel packages and pushed poisoned container images. This is consistent with prior supply-chain abuse of CI/CD credentials, mirroring the March TeamPCP incident where CI/CD secrets from Aqua Security's Trivy scanner were abused. The Cloud Native Security Fabric (CNSF) with inline enforcement and distributed policy could have flagged anomalous automation behavior during the release process; a Cloud Firewall (ACF) with AI-based traffic discovery could have identified suspicious outbound connections from the build pipeline.
MITRE ATT&CK® Techniques
Compromise Software Supply Chain
Compromise Client Software Binary
Command and Scripting Interpreter: Python
Unsecured Credentials: Credentials In Files
Exfiltration Over Web Service: Exfiltration to Code Repository
Obfuscated Files or Information
Scheduled Task/Job: Cron
File and Directory Discovery
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Software Integrity and Secure Software Development
Control ID: Requirement 6.3.3
NYDFS 23 NYCRR 500 – Monitoring of Authorized Users and Third-Party Access
Control ID: Section 500.14
DORA (EU) 2022/2554 – Third-Party ICT Supply Chain Integrity
Control ID: Article 28 – ICT Third-Party Risk Management
NIS2 Directive (EU) 2022/0383 – Security of the Supply Chain Including Software
Control ID: Article 21(2)(d) – Supply Chain Security
CISA Zero Trust Maturity Model 2.0 – Least Privilege and Runtime Integrity for Application Environments
Control ID: Applications Pillar – Application Access Authorization
ISO/IEC 27001:2022 – Secure Software Supply Chain and Third-Party Code Governance
Control ID: Annex A 8.30 – Outsourced Development
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Information Technology/IT
LiteLLM's compromised PyPI pipeline directly targets IT teams using AI gateways; stolen AWS, Azure, Kubernetes, and CI/CD credentials enable lateral movement and mass exfiltration across cloud infrastructure.
Computer Software/Engineering
Software engineers integrating LiteLLM face supply-chain infostealer exposure; malicious .pth and sitecustomize.py hooks silently harvest Git, GitHub, npm, PyPI, and SSH keys on every Python invocation.
Financial Services
Financial platforms leveraging LiteLLM's AI gateway risk credential theft and browser payment-data exfiltration; PCI 4.0 egress and NIST.800-53.SC-7 controls are directly implicated by validated kill-chain data.
Health Care / Life Sciences
Healthcare organizations using LiteLLM for AI model routing face HIPAA 164.312(e)(1) violations; stolen environment variables and cloud secrets expose protected health data via undetected AES-256/RSA-4096 exfiltration channels.
Sources
- LiteLLM release pipeline hacked to distribute info-stealer malwarehttps://www.bleepingcomputer.com/news/security/litellm-release-pipeline-hacked-to-distribute-info-stealer-malware/Verified
- LiteLLM Security Incident - October 21, 2026 Post-Mortemhttps://docs.litellm.ai/blog/security-incident-oct-21-2026Verified
- Socket Research: LiteLLM Compromise - The Collector Reaches Beyond Provider API Keyshttps://socket.dev/blog/litellm-compromise#The-Collector-Reaches-Beyond-Provider-API-KeysVerified
- Endor Labs: LiteLLM 1.107.0 Compromised - Python Startup Hooks Steal Cloud, AI, and Proxy Credentialshttps://www.endorlabs.com/learn/litellm-1-107-0-compromised-python-startup-hooks-steal-cloud-ai-and-proxy-credentialsVerified
- Popular LiteLLM PyPI package compromised in TeamPCP supply-chain attack (prior incident, March 2026)https://www.bleepingcomputer.com/news/security/popular-litellm-pypi-package-compromised-in-teampcp-supply-chain-attack/Verified
- CISA Known Exploited Vulnerabilities Cataloghttps://www.cisa.gov/known-exploited-vulnerabilities-catalogVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
The LiteLLM supply-chain compromise demonstrates precisely where Aviatrix Zero Trust CNSF adds meaningful friction — from the moment malicious code first reaches a runtime environment through to credential exfiltration over a disguised HTTPS channel. By enforcing segmentation, controlling egress destinations, and limiting east–west reachability across cloud and pipeline contexts, CNSF would likely have reduced the attacker's ability to harvest and move credentials at the scale observed.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Inline enforcement and distributed policy inspection across the build and release pipeline could have flagged anomalous outbound connection attempts from CI/CD automation, reducing the attacker's ability to operate freely within the release infrastructure without raising observable signals.
Control: Zero Trust Segmentation
Mitigation: Identity-aware segmentation policies enforced at the workload level could have constrained which secrets, metadata endpoints, and adjacent services the Python runtime was permitted to reach — reducing the scope of credentials the malware was realistically able to harvest from any single compromised environment.
Control: East-West Traffic Security
Mitigation: East–west enforcement monitoring workload-to-workload and service-to-service communication flows could have identified anomalous cross-environment API calls originating from newly compromised identities, likely constraining the attacker's ability to pivot freely across cloud accounts and pipeline infrastructure without detection.
Control: Multicloud Visibility & Control
Mitigation: Centralized traffic observability across cloud workloads could have flagged the periodic, low-volume outbound polling behavior as anomalous — particularly when originating from runtime environments not expected to initiate scheduled external connections — likely reducing the attacker's ability to maintain reliable C2 communication undetected.
Control: Egress Security & Policy Enforcement
Mitigation: FQDN-based outbound filtering enforced at the egress layer could have blocked connections to the attacker-controlled exfiltration endpoint — even one crafted to resemble a legitimate service domain — likely constraining the attacker's ability to successfully deliver encrypted credential packages outside the environment.
Where prior CNSF controls were in place across the affected stages, the realistic scope of credential exposure would likely have been narrowed — fewer reachable secrets, fewer successful lateral pivots, and fewer completed exfiltration uploads — reducing the number of cloud accounts and pipelines the attacker could access from harvested material before detection.
Impact at a Glance
Affected Business Functions
- AI/ML Platform Delivery and SDK Distribution
- CI/CD Pipeline Integrity and Software Release Management
- Cloud Infrastructure Credential Management (AWS, Azure, GCP, Kubernetes)
- Developer Secrets and API Key Security for AI Provider Integrations
Estimated downtime: 1 days
Estimated loss: N/A
The malware exfiltrated a broad range of highly sensitive data from all affected installations of LiteLLM 1.107.0 across Windows, Linux, and macOS environments. Stolen data categories include: cloud and infrastructure deployment credentials (AWS, Azure, Google Cloud, Kubernetes, Docker secrets); AI platform authentication tokens and LiteLLM provider API keys and model configuration; developer secrets including Git, GitHub, npm, PyPI, and CI/CD credentials, .env files, SSH keys, GPG keys, and TLS certificates; browser-stored credentials, session cookies, autofill and payment data, and browsing history; and host runtime data including environment variables, shell histories, and system network information. The malware also deployed a persistent hourly loader capable of remote code execution. Given that LiteLLM reports 92 million monthly PyPI downloads and is used by NVIDIA, Netflix, AT&T, and Okta, the potential scope of credential compromise spans thousands of enterprise AI deployments. All exfiltrated data was encrypted with AES-256-CBC and RSA-4096 before being uploaded to the attacker-controlled endpoint litellm[.]dev/healthcheck. The persistent loader (sitecustomize.py) introduced ongoing RCE risk beyond the initial credential theft window.
Recommended Actions
Key Takeaways & Next Steps
- • Apply Egress Security & Policy Enforcement with FQDN filtering on all build, CI/CD, and runtime environments to block outbound connections to unauthorized destinations, preventing exfiltration to attacker-controlled endpoints masquerading as legitimate service health-check URLs.
- • Deploy Cloud Native Security Fabric (CNSF) inline enforcement and Multicloud Visibility & Control to baseline and continuously monitor automation and release pipeline traffic, enabling rapid detection of anomalous publishing activity or unexpected outbound polling loops introduced by compromised build steps.
- • Enforce Zero Trust Segmentation with least-privilege identity-based policy on all container and Kubernetes workloads to restrict what secrets, IAM roles, and environment variables are accessible to Python runtime processes, limiting the blast radius of startup-hook credential harvesting.
- • Implement East-West Traffic Security controls to monitor and restrict workload-to-workload and service-to-service flows, ensuring that credentials harvested in one environment cannot be immediately leveraged for lateral movement across cloud accounts, pipelines, and developer infrastructure.
- • Activate Inline IPS (Suricata) on egress paths from build and runtime environments with updated signatures for known infostealer exfiltration patterns and Cloud Firewall (ACF) URL filtering to detect and block encrypted data uploads to typosquatted or newly registered domains at the network layer independent of endpoint controls.
