Unrevoked LiteLLM Master Key Enabled 49,000 Downloads of Credential-Stealing Package 1.107.0
LiteLLM’s failure to revoke an exposed master key enabled a supply-chain attack that pushed malware to 49,000 users and facilitated LLMjacking of AWS accounts. The incident reveals recurring key-management failures in AI tooling and the shift toward billing-focused cloud abuse. Affected entities must rotate every reachable credential.
The attacker leveraged the still-valid key to extract tokens granting full repository write access, then bypassed multiple independent controls to upload a package that executed on Python startup regardless of LiteLLM usage. Wiz telemetry showed stolen credentials tested against AWS AI endpoints within hours, matching documented LLMjacking behavior where victims incur compute costs for unauthorized model calls. Microsoft confirmed the malware’s persistence mechanism ran independently of any LiteLLM import.
This marks the second LiteLLM supply-chain incident in 2024 after March’s TeamPCP-linked campaign. The repeated failure to rotate the master key after public exposure reveals a systemic gap in open-source AI tooling where rapid iteration outpaces key-management discipline. The pattern aligns with broader targeting of developer platforms that proxy cloud AI services, turning supply chains into direct billing-attack vectors rather than data exfiltration plays.
Organizations that installed 1.107.0 must treat all reachable credentials as compromised and rotate them immediately. LiteLLM has begun mass token revocation across internal and vendor systems. Expect continued scrutiny of PyPI upload controls and renewed focus on automated key-rotation requirements for any project handling cloud AI credentials.
Wiz: More than 200 distinct AWS accounts show unauthorized AI model invocations from LiteLLM-harvested keys by October 20
Sources (2)
- [1]The Record(https://therecord.media/litellm-hackers-ai-malware)
- [2]Wiz Research(https://www.wiz.io/blog/litellm-supply-chain-attack)