LiteLLM ties malicious 1.107.0 to leaked key; users must rotate credentials

What happened

Attackers hijacked LiteLLM's release pipeline on October 21 and distributed version 1.107.0 with malware through PyPI and the official Docker and GHCR images. The malicious version stayed online for roughly three hours and was downloaded about 49,000 times from PyPI. The packages were removed and LiteLLM attributes the attack to a key accidentally exposed in May and never revoked.

Why it matters

The malware stole browser passwords, cloud keys (AWS, GCP, Azure), SSH and GPG keys, CI secrets and the AI provider API keys stored in the LiteLLM proxy, and also fetched attacker code every hour. Wiz reported stolen credentials in use about 4.5 hours after theft, including queries to Amazon Bedrock models. LiteLLM estimates the attack may have reached tens of thousands of users; enterprise customers on the private registry were not affected, according to the company.

What to do

Check whether version 1.107.0 or images from the latest, main-latest and main-stable tags were installed or run on October 21. If so, remove the version, pin 1.106.2 or a later clean release, sweep the host for malware and rotate every reachable credential, including cloud keys, AI tokens and CI secrets. Block the domain litellm[.]dev.

For the technical team

Affected

LiteLLM (PyPI e imagens oficiais de Docker/GHCR) · litellm 1.107.0 on PyPI (all 7 wheels: macOS, Linux glibc and musl, Windows; the sdist has a tampered pyproject.toml with a data = cook line but no payload); images ghcr.io/berriai/litellm, litellm-database, litellm-non_root and docker.io/litellm/litellm with tags v1.107.0, latest, main-latest and main-stable between 11:46 and 14:20 UTC on October 21. Versions 1.107.0rc1, 1.107.0rc2 and the 1.106.x line and earlier inspected are clean.

Exploitation

Confirmed exploitation, contained: about 49,000 PyPI downloads before removal (SecurityWeek, StepSecurity). Wiz saw stolen AWS credentials validated about 4.5 hours after exfiltration, queries to Amazon Bedrock models (LLMjacking) and, in a small number of environments, listing of IAM roles, users and access keys. Registered by OSV as MAL-2026-2144.

Fix

1.107.0 removed from PyPI, Docker Hub and GHCR; clean releases resumed October 24. Pin litellm==1.106.2 (last known safe version, per Wiz) or a later clean release (e.g. 1.106.4, cited by StepSecurity), or an image by digest. Cleanup: delete cook.pth, cook.py and sitecustomize.py from site-packages, kill the Python process holding /tmp/remote_code_loader.lock, block litellm[.]dev and rotate reachable credentials.

Vector

Release workflow hijacking with a GitHub organization owner's GitHub CLI OAuth token, taken from an unexpected user account in LiteLLM's internal deployment exposed to the public internet; LiteLLM suspects Claude Code embedded tokens into response bodies saved in its logs and that initial access came through a recently patched vulnerability. Using three engineers' credentials, the attacker disabled branch protections, pointed the workflow at the lookalike repository Berri-AI/litellm and published signed artifacts. The payload lands as cook.pth, cook.py and sitecustomize.py in site-packages and runs on every Python interpreter start, without importing litellm.

More details

Second LiteLLM supply chain attack in 2026, after 1.82.7/1.82.8 in March (linked to 2,488 corporate domains per Hudson Rock and close to 2,500 organizations per CloudSEK). Windows: PyPI 11:39 to 13:23 UTC; GHCR tags unavailable by 13:51 UTC; Docker Hub tags repointed at 14:20 UTC. litellm.dev registered October 13, 2026 at 00:45 UTC; account letters9813 created six hours later. The stealer collects browser passwords, cookies, browsing and shell history, SSH/GPG keys, AWS/Azure/GCP/Kubernetes/Docker credentials, the environment of every running process, configs of more than 20 AI tools (Codex, Claude, Gemini, Cursor) and proxy database keys; it encrypts and posts to litellm[.]dev. The second stage checks a GitHub dead drop hourly and runs attacker-served Python. Weekly LiteLLM downloads: about 23 million (Socket). StepSecurity says the token was stolen 11 days earlier via a never-revoked key, and Socket reports secret-stealing workflows running 11 days before the attack. Original v1.107.0 tag commit: 66c8f5b1a9.

Timeline

1. 10/26/2026 01:47 PM

   LiteLLM says the attack stemmed from a key accidentally exposed in May and never revoked, and may have hit tens of thousands of users.

2. 10/26/2026 01:17 PM

   OSV lists the malicious package; version removed and users urged to rotate credentials.

Sources 12 sources

• OSV MAL-2026-2144 OSV
• Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline The Hacker News
• LiteLLM Compromised in Fresh Supply Chain Attack SecurityWeek
• LiteLLM release pipeline hacked to distribute info-stealer malware BleepingComputer
• LiteLLM hit by second supply chain attack this year, users urged to rotate credentials Help Net Security

See all 14 sources

• litellm 1.107.0 Compromised on PyPI: Backdoored Wheels Drop a Credential Stealer and an Hourly Remote Code Loader StepSecurity
• Contained: Oct 21, 2026 LiteLLM release v1.107.0 Compromised LiteLLM
• Datadog Security Labs analysis Datadog
• Wiz: LiteLLM Compromised, Steals Credentials Wiz
• LiteLLM Hijacked Again: Malicious 1.107.0 Wheels Steal Credentials and Load Remote Code JFrog Security Research
• LiteLLM Suspects GitHub Token Leak in AI Gateway Logs Behind Malicious Package Release The Hacker News
• LiteLLM PyPI Package and Docker Images Compromised to Steal Cloud and AI Credentials Socket
• New Evidence Shows LiteLLM Secret-Stealing Workflows Ran 11 Days Before Supply Chain Attack Socket
• Popular AI tool LiteLLM says unrevoked key allowed hackers to target users The Record

See all news