LiteLLM Supply Chain Attack: Stolen Developer Tokens Shipped Malicious Packages That Stole Cloud Keys

The LiteLLM supply chain attack, in brief

The LiteLLM supply chain attack is the kind of incident that should make every team using open source AI tooling pause. LiteLLM, a widely used open source AI gateway, confirmed an October 21 supply chain attack in which attackers used stolen developer tokens to publish malicious packages and Docker images. The compromised version, 1.107.0, was designed to steal cloud credentials and AI service secrets, and the attackers subsequently tested stolen AWS credentials. If you run LiteLLM, the question is not whether this is interesting. It is whether you installed the bad version.

Supply chain attacks work because they abuse trust. Nobody audits every package update by hand. When a trusted project ships a new version, thousands of systems pull it automatically, and the malicious code rides in through the same channel as the legitimate fixes. That is what makes this incident different from a phishing email or a misconfigured server: the attack came from inside the distribution pipeline.

How the attack worked

According to Check Point's weekly threat report, the attackers obtained developer tokens and used them to publish the malicious packages and images. Tokens are the quiet credentials of modern software development. They let automated systems publish releases without a human typing a password, which is convenient and, when a token leaks, catastrophic. A single stolen token can be enough to poison a release that thousands of people trust.

The payload was purpose-built for AI infrastructure. LiteLLM sits between applications and AI providers, which means it legitimately handles API keys, cloud credentials, and routing configuration. Malware in that position does not need to break into your systems. It is already standing where the secrets pass through. Reports say the attackers tested stolen AWS credentials after the fact, which is the expected next step: a stolen key is only valuable once you confirm it works.

Why AI gateways are now prime targets

AI gateways have become critical infrastructure faster than their security practices have matured. A year ago, LiteLLM was a handy proxy for developers juggling model providers. Today it is a component in production systems that handle real customer data and real cloud spend. Attackers follow value, and the value has moved to the AI layer.

This is the same pattern as the ConnectWise supply chain attack, where a trusted channel became the attack path into customer tenants. The lesson repeats because the economics repeat: compromising one widely used component pays off across thousands of victims, while attacking each victim individually does not scale. Expect more attacks on AI tooling, not fewer, as AI spending grows.

What to do if you run LiteLLM

First, check your version. If you are on 1.107.0 from the compromised release, treat it as untrusted: remove it, rotate every credential it could have touched, and review AWS and AI provider logs for unexpected use. Rotating keys is annoying, but it is cheaper than explaining a cloud bill run up by someone else.

Second, pin your versions. Automatic updates to the latest release are convenient until the latest release is malicious. Pin to a known good version, review release notes before upgrading, and verify package signatures or hashes where the project provides them. The October browser and system updates, including the Chrome and Firefox security fixes, are a reminder that patching matters, but supply chain incidents are the case where blind patching hurts.

Third, scope your tokens. Developer tokens should have the minimum permissions needed, short lifetimes where possible, and alerts on unusual use. If a token can publish a release, it should be treated with the same care as a production password, because that is what it is.

The bigger lesson for open source users

None of this is an argument against open source. LiteLLM's openness is also why the compromise was found and disclosed quickly, with a clear version number and a clear remediation path. Closed software has supply chain incidents too, and they are often harder to detect.

The real lesson is about assumptions. Teams that adopted AI gateways as developer conveniences need to start managing them as production infrastructure, with version pinning, secret rotation, and monitoring. If you are not sure whether your data was exposed in any incident, our guide on checking if your data was leaked is a good starting point. The LiteLLM incident will not be the last supply chain attack on AI tooling, but it is a clear warning, and warnings are only useful if someone acts on them.