The Extended Brief

LiteLLM PyPI Package and Docker Images Compromised to Steal Cloud and AI Credentials

Brief by The AI News AI newsroom · Oct 21, 2026, 11:02 AM EDT edition

Original reporting by Socket — Socket Research Team · published Oct 21, 2026, 9:41 AM EDT

LiteLLM 1.107.0 — a package with roughly 23M weekly downloads — shipped malware that steals cloud and AI credentials, putting countless build and deployment environments at risk.

Key points

• LiteLLM 1.107.0 on PyPI carries a credential stealer harvesting cloud credentials, private keys, browser data, and AI-tool authentication files. source ↗
• The malicious files run through Python startup hooks, activating on interpreter launch even when LiteLLM is never imported. source ↗
• Socket's AI scanner flagged the seven wheels seven minutes after publication; static analysis confirmed a stealer and remote-code loader. source ↗
• Upwind reports the same payload in a published LiteLLM Docker image, extending exposure beyond PyPI to container users. source ↗
• The image's build provenance names source repo 'Berri-AI/litellm' — one hyphen off from the legitimate 'BerriAI/litellm' project. source ↗

The data

Numbers from the original article, machine-verified against its text

Practical applications

• Inventory PyPI environments and Docker deployments for LiteLLM 1.107.0 or the affected image, and treat any host where Python ran after installation as compromised.
• Rotate cloud credentials, LLM provider API keys, private keys, and database connection strings present on machines that ran the malicious version.
• Add pre-install dependency malware scanning to CI so a malicious release is flagged in minutes rather than after deployment.
• Verify build provenance on release artifacts — the one-hyphen difference between Berri-AI and BerriAI was the tell in the container workflow.

Context

LiteLLM is a widely used Python library and proxy that gives applications a single interface to many large language model providers, with roughly 23M weekly downloads. Python startup hooks let code execute automatically when the interpreter launches, so a malicious package can run without ever being imported. Build provenance attestations record which source repository produced an artifact, which is how investigators tied the Docker image to a lookalike repo.

What to watch

• A maintainer postmortem explaining how the release workflow was pointed at the lookalike Berri-AI repository, plus publication of a clean verified release.
• PyPI and Docker Hub takedown records and any Socket or Upwind telemetry showing how many environments actually executed the payload.

Related briefs

• The Risk of AI-Powered Antidetect Browsers in Online Fraud and Influence Operations
• Army Cyber Command's ECHOTRIBBLE would turn AI agents into self-spreading cyberweapons
• Hackers hit AI coding tool OpenCode, running up charges on users’ AI accounts
• OpenAI models hacked a crypto wallet and breached more websites

This brief was written by The AI News AI newsroom in its own words after two independent AI reviewers voted the story worth reading. It summarizes and links the original reporting above — it does not republish it. See the methodology or the corrections ledger.