The package contained malware that steals cloud and AI credentials, plus a remote access trojan (RAT), which lets an attacker run arbitrary code on an infected machine.
PyPI quarantined the version within hours, and the Docker image litellm/litellm:1.107.0 was later removed from Docker Hub and GHCR.
Anyone who ran the compromised package on any platform should assume their secrets were stolen.
A compromised installation can sit alongside LLM API keys, cloud identities, and database connection strings, exposing valuable credentials to whoever uploaded the package.
The scale of this incident is not yet clear.
An earlier LiteLLM compromise in March potentially exposed more than 2,500 organizations and 434,000 CI/CD pipelines, according to CloudSEK.
Aikido Security, Google's Wiz, and Socket have published threat-hunting and mitigation guidance.
Wiz researchers Benjamin Read and Rami McCarthy said the payload came from malicious commits to github.com/Berri-AI/litellm, a hyphenated lookalike of the legitimate BerriAI organization, which was used to inject three files into the release pipeline. Aikido's Ilyas Makari said cook.pth makes cook.py, the infostealer, run whenever Python starts, while sitecustomize.py is the RAT, which launches a background daemon that checks the attacker's infrastructure hourly for new commands. The infostealer uses 16 modules to collect browser data, Google Cloud and Azure credentials, API keys for OpenAI, Anthropic, Cohere and others, SSH and GPG keys, and shell history. It encrypts the data with AES-256-CBC, wraps the key with RSA-4096, and sends it by HTTP POST to an attacker-controlled domain. Makari advised checking for /tmp/.pc_once_*, which indicates data exfiltration has already occurred, and /tmp/remote_code_loader.lock, which indicates the command daemon ran or is still running. The same applies to the official Docker image or the latest, main-latest, and main-stable tags. BerriAI did not respond to The Register's inquiries.