Attackers built from a hyphenated lookalike fork — and started testing the stolen cloud keys within hours

The attackers built the poisoned release from a hyphenated lookalike fork — Berri-AI/litellm, one hyphen off from the legitimate BerriAI/litellm — so the malicious build carried seemingly legitimate build provenance through LiteLLM's own release pipeline. Docker's floating tags (latest, main-latest, main-stable) also served the malware between 11:46 and 14:20 UTC on October 21.

The theft wasn't theoretical: Wiz observed the attackers validating stolen AWS instance-role credentials about 4.5 hours after exfiltration, then listing Amazon Bedrock models and enumerating IAM — a pattern consistent with LLMjacking. LiteLLM advises anyone who installed 1.107.0 to assume full compromise, pin 1.106.2 by digest, and rotate every credential the host could read.