LiteLLM hijacked again: malicious 1.107.0 installation package steals credentials and loads remote code
The JFrog security research team found that all seven platform wheels of litellm 1.107.0 on PyPI were implanted with malicious code, and the official litellm/litellm:1.107.0 Docker image was also affected; PyPI and Docker Hub have removed the related artifacts. The source package does not contain these three malicious files, and reviewing only the source, Git tags, or sdist would miss the malicious behavior in the wheel. This is the second time LiteLLM has been hijacked in 2026, and JFrog says there is no evidence linking it to the March TeamPCP incident; LiteLLM said on October 22 that the incident was contained, and JFrog recommends discarding all 1.107.0 wheels, deleting the startup hook first, then rotating credentials and rebuilding the environment.
The article compares the differences between the source package and the wheel, explains that reviewing only the source or Git tags would miss malicious code in the binary artifacts, and provides a complete remediation checklist.