What Happened
The Hacker News reports attackers compromised LiteLLM’s release pipeline on October 21 and published version 1.107.0 to PyPI, Docker Hub, and GHCR. The package carried a credential stealer and a Linux and macOS backdoor. A malicious cook.pth file ran the stealer, which sent data to litellm[.]dev. Pip users were exposed from 11:39 to 13:23 UTC. Docker users were exposed from 11:46 to 14:20 UTC.
LiteLLM suspects GitHub CLI OAuth tokens leaked into gateway logs. The attacker used them to disable branch protections, run a workflow against a lookalike repository, and publish signed artifacts. About 4.5 hours after exfiltration, the attacker tested stolen AWS credentials in patterns matching LLMjacking.
Why This Matters for Canadian Organizations
LiteLLM is a popular gateway for routing requests to AI model providers. Canadian startups, banks, and public-sector pilot teams use it to manage model access in one place. This position holds cloud keys, model API keys, and database credentials.
A leaked AWS role in a Canadian account is a security incident and a billing incident. Stolen keys run up model costs within hours. If the exposed environment holds personal information, you face a PIPEDA breach assessment. Teams who pull unpinned images in automated builds had no chance to review the release.
What to Do
Search your lockfiles, container registries, and build logs for LiteLLM 1.107.0. Remove it and isolate affected hosts. Hunt for cook.pth, cook.py, sitecustomize.py, and the lock file /tmp/remote_code_loader.lock. Block litellm[.]dev and the IP addresses 168.100.8[.]57 and 165.227.201[.]8.
Rotate every credential reachable from affected systems, including AWS, GitHub, and CI secrets, then rebuild the environment. Pin exact package hashes and stop pulling latest tags in production. Read more in our TechTalk archive.
