AI Agent UpdateThe biggest AI supply-chain attack of the year just happened — inside a package with 23M weekly downloads
A compromised LiteLLM release shipped a credential stealer and an hourly backdoor for ~3 hours. Your cloud keys, SSH keys and AI coding-tool settings were the target.
The News
LiteLLM is an open-source tool that sits between AI applications and the model providers — a proxy that lets developers call many different AI models through one door. On October 21, that door was booby-trapped. According to LiteLLM and security researchers, attackers used stolen GitHub login tokens belonging to three LiteLLM engineers to trigger the project's private release machinery against a lookalike copy of the project — hosted under the name “Berri-AI/litellm,” one hyphen away from the legitimate “BerriAI/litellm” — and published poisoned packages to PyPI, the main storehouse for Python software, between 11:39 and 13:23 UTC. Docker and GHCR images carrying the “latest” tags were affected until about 14:20 UTC.
The malware had two parts. The first, a credential stealer nicknamed “privcollect,” was rigged to run every time the Python interpreter starts — so it fired even if a developer never actually used LiteLLM that day. It harvested cloud account credentials, SSH and GPG keys, saved browser passwords, environment variables, the stored settings of AI coding tools (Cursor, Claude, Codex, Gemini and Copilot), and the provider keys stored inside LiteLLM proxy servers themselves. The second part was a backdoor that checks a GitHub page once an hour for a new address, then downloads and runs whatever code it finds there — a standing invitation for a second stage of attack.
The scale is what makes this the year's biggest AI supply-chain incident: LiteLLM is downloaded roughly 23 million times a week, and this is the second time the project has been compromised in a year. LiteLLM has pulled the release and revoked the stolen tokens. The standing advice for anyone who installed version 1.107.0: pin version 1.106.2 and rotate — replace — every secret on the machine. The stock market, meanwhile, did what it now does on attack days: cybersecurity shares rallied on separate news of an AI-found PHP zero-day the same session, with CrowdStrike up 6% to about $241, Cloudflare up 7% to about $312, Zscaler up 7% to about $230, Palo Alto Networks up 4% to about $353 and SentinelOne up 5% to about $23.
pip install just read your ~/.aws — the biggest AI supply-chain attack of the year hit a package with 23M weekly downloads.
Why It Matters
AI developer infrastructure is now the highest-value supply-chain target in software. Compromise one widely used proxy and you do not get one company's keys — you get the cloud and model keys of thousands of companies that trusted it. The lookalike-fork trick is the part that should worry every engineering team: the attackers did not just poison code, they hijacked the release pipeline — the machinery that decides what counts as an official version. Release pipelines, not just code, are now the target.
For security budgets, the read-through is direct: every incident like this is a line item in the case for AI-era defense spending, and the sector's stock chart the same day — $CRWD and $PANW up on attack news — shows the market already prices it that way.
Analyst's Take
The bullish trade here is uncomfortable but simple: every real AI attack lands in the cyber vendors' lap as revenue. CrowdStrike up 6% and Zscaler up 7% on the same day their customers' tooling got owned is the market voting that offense creates defense budgets faster than it destroys trust.
The deeper signal is for builders, and it is not flattering. Pin your dependencies to exact versions. Verify your release pipelines the way you verify your code. And assume your AI stack's keys — cloud, model providers, coding tools — are on a nation-state's shopping list, because a package with 23 million weekly downloads just proved they are. A second compromise of the same project in one year is not an incident; it is a campaign against AI infrastructure, and it should be budgeted for like one.
By The Numbers
FAQ
What is LiteLLM and why does it matter?
LiteLLM is a popular open-source proxy that lets software talk to many different AI model providers through one interface. Because it sits in the middle of AI applications, it handles — and stores — the API keys for those providers, which is exactly what made it a valuable target.
What is a supply-chain attack?
Instead of attacking thousands of companies one by one, attackers poison a shared ingredient those companies all use — here, a software package. Everyone who installed the tampered version during the roughly three-hour window installed the malware with it.
What should I do if I downloaded 1.107.0?
Pin LiteLLM to version 1.106.2 and rotate your secrets: replace cloud credentials, SSH keys and AI provider keys that were stored on any machine that ran the bad release. Because the stealer ran at Python startup, simply deleting the package is not enough — assume the keys were seen.
How does the lookalike-fork trick work?
The attackers worked through a copy of the project hosted under “Berri-AI/litellm” — nearly identical to the real “BerriAI/litellm,” with one extra hyphen. Using stolen engineer tokens, they got LiteLLM's own release pipeline to build and publish from the lookalike, so the poisoned packages arrived through the official channel users trust.
Source: The Hacker News / Datadog Security Labs