● Covered by 4 sources · 6 reportsMedium impact6 negative
LiteLLM 1.107.0 on PyPI Compromised with Credential Stealer and Backdoor
Key points
- LiteLLM 1.107.0 on PyPI and Docker images contained a credential stealer and backdoor.
- Malicious code collected SSH keys, cloud credentials, AI tool tokens, and browser data.
- A background daemon provided remote code execution capabilities.
- Stolen GitHub CLI OAuth tokens from three engineers were used to publish the release.
- PyPI removed the compromised release; LiteLLM is investigating the attack vector.
- The attack compromised multiple independent security controls.
- The incident occurred on October 21, 2026, around 4:00 a.m. PST.
- Compromised Docker images included 'latest', 'main-latest', and 'main-stable'.
- Compromised versions were also published to GHCR.
- Users downloading unpinned versions via pip between 11:39 a.m. and 1:23 p.m. UTC were impacted.
- Docker image users between 11:46 a.m. and 2:20 p.m. UTC were impacted.
- The malicious code ran a stealer routine named 'privcollec' every hour.
- Malicious PyPI packages and Docker images were distributed for LiteLLM version 1.107.0.
- The supply-chain attack affected all PyPI wheels for LiteLLM version 1.107.0.
- LiteLLM is an open-source Python SDK and AI gateway.
- LiteLLM has 61,800 GitHub stars and 92 million monthly downloads on PyPI.
- NVIDIA, Netflix, AT&T, and Okta use LiteLLM.
- Customers running the private enterprise version were not impacted.
- Malicious packages were online for roughly three hours.
- Malicious packages were downloaded over 49,000 times.
- Docker Hub tags and image variants were removed or repointed to clean artifacts.
- Attackers obtained GitHub CLI OAuth tokens from an unexpectedly named user account in an internal LiteLLM deployment.
- Tokens were likely leaked by Claude Code embedding them into a response body, logged to LiteLLM logs.
- A LiteLLM Agent Platform master key was accidentally published to a public GitHub repository in May 2026.
- The master key was not revoked after being exposed.
- An attacker used the unrevoked master key on October 10, 2026, to access the Agent Platform.
- The attacker extracted a GitHub CLI OAuth token from the Agent Platform.
- The extracted GitHub CLI OAuth token was not scoped down and was associated with the GitHub organization owner's account.
- The master key was in a configuration file committed to the LiteLLM-Labs/lite-harness repository.
- The attacker operated from IP address 69.48.229[.]143.
Compromised LiteLLM Release
The LiteLLM Python package version 1.107.0 was compromised in a software supply chain attack. This affected release, distributed through PyPI wheels and Docker images, contained a credential stealer and a remote code execution backdoor. PyPI has since quarantined the Python package, and the malicious Docker images have been removed.
Malicious Functionality
Installing `litellm==1.107.0` placed three files in `site-packages`. Two of these files were loaded every time a Python process started. One file, `cook.py`, acted as a credential stealer, collecting SSH keys, cloud credentials, CI/CD secrets, AI tool tokens, browser passwords, and LLM provider keys from a LiteLLM proxy database. This collected data was encrypted and sent to `www.litellm[.]dev`.
The other file, `sitecustomize.py`, initiated a background daemon. This daemon would read a server address from a GitHub file hourly, re-run the credential stealer, and download and execute additional code from that server, establishing a persistent backdoor.
Attack Vector Identified
Oliver Jensen, director of security at LiteLLM, stated that the malicious actions were carried out using stolen GitHub CLI OAuth tokens from three engineers' accounts. One user's account triggered the project-releaser run, and another user's account approved it. All tokens involved in the attack have been revoked.
The mechanism by which the threat actor acquired these tokens is still under investigation, and LiteLLM has not yet confirmed that there is no further access to these GitHub accounts.
Unaffected Versions
The upstream GitHub source for LiteLLM does not contain the malicious code. Versions 1.106.2, 1.107.0rc1, and 1.107.0rc2 are clean. Additionally, the companion packages pinned by 1.107.0, `litellm-proxy-extras==0.4.110` and `litellm-enterprise==0.1.78`, were also found to be clean.
Updates
- A LiteLLM Agent Platform master key was accidentally published to a public GitHub repository in May 2026.
- The master key was not revoked after being exposed.
- An attacker used the unrevoked master key on October 10, 2026, to access the Agent Platform.
- The attacker extracted a GitHub CLI OAuth token from the Agent Platform.
- The extracted GitHub CLI OAuth token was not scoped down and was associated with the GitHub organization owner's account.
- The master key was in a configuration file committed to the LiteLLM-Labs/lite-harness repository.
- The attacker operated from IP address 69.48.229[.]143.
- Malicious packages were online for roughly three hours.
- Malicious packages were downloaded over 49,000 times.
- Docker Hub tags and image variants were removed or repointed to clean artifacts.
- Attackers obtained GitHub CLI OAuth tokens from an unexpectedly named user account in an internal LiteLLM deployment.
- Tokens were likely leaked by Claude Code embedding them into a response body, logged to LiteLLM logs.
- Malicious PyPI packages and Docker images were distributed for LiteLLM version 1.107.0.
- The supply-chain attack affected all PyPI wheels for LiteLLM version 1.107.0.
- LiteLLM is an open-source Python SDK and AI gateway.
- LiteLLM has 61,800 GitHub stars and 92 million monthly downloads on PyPI.
- NVIDIA, Netflix, AT&T, and Okta use LiteLLM.
- Customers running the private enterprise version were not impacted.
- The attack compromised multiple independent security controls.
- The incident occurred on October 21, 2026, around 4:00 a.m. PST.
- Compromised Docker images included 'latest', 'main-latest', and 'main-stable'.
- Compromised versions were also published to GHCR.
- Users downloading unpinned versions via pip between 11:39 a.m. and 1:23 p.m. UTC were impacted.
- Docker image users between 11:46 a.m. and 2:20 p.m. UTC were impacted.
- The malicious code ran a stealer routine named 'privcollec' every hour.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
Primary sources
GitHub safedep/vet GitHub safedep/pmg GitHub safedep/xbom GitHub safedep/gryph GitHub BerriAI/litellm PyPI litellmHow outlets covered it
A LiteLLM Agent Platform master key, accidentally published to a public GitHub repository in May 2026 and not revoked, was used by an attacker to gain access to LiteLLM's GitHub organization. This access allowed the attacker to hijack the release pipeline and publish a malicious version of the LiteLLM Python package to PyPI on October 21, 2026. This incident highlights the critical importance of immediate key revocation and proper scope management for access tokens.
LiteLLM experienced a supply chain attack on October 21, leading to the distribution of malicious version 1.107.0 packages on PyPI and Docker for approximately three hours. The attack compromised GitHub CLI OAuth tokens, which were used to publish malware that functions as an information stealer and remote access Trojan.
Hackers compromised the LiteLLM project's release pipeline, distributing malicious PyPI packages and Docker images for version 1.107.0. The malware steals credentials, secrets, and environment variables, affecting users of the popular AI gateway.
LiteLLM's release pipeline was compromised, leading to the distribution of a malicious Python package (v1.107.0) and Docker images containing a credential stealer and backdoor. The attack involved multiple security control bypasses and impacted users who downloaded unpinned versions or specific Docker images between 11:39 a.m. and 2:20 p.m. UTC on October 21, 2026.
The LiteLLM Python package version 1.107.0 was compromised in a supply chain attack, distributing a credential stealer and backdoor via PyPI and Docker images. The attack used stolen GitHub CLI OAuth tokens from three engineers' accounts to publish the malicious release, which collected cloud credentials, private keys, and browser data.
The LiteLLM 1.107.0 release on PyPI was compromised, installing a credential stealer and remote code execution backdoor on systems. This malicious code ran every time a Python process started, collecting sensitive data and establishing a persistent backdoor, prompting PyPI to remove the release.