LiteLLM 1.107.0 incident analysis: how the release pipeline was compromised and why signing failed to protect
On October 21, 2026, litellm==1.107.0 on PyPI was implanted with credential-stealing code, and the Docker image with the same tag was also infected. This is the second supply chain incident within a year for the open-source LLM gateway LiteLLM, following the compromise of 1.82.7/1.82.8 in March 2026. The author synthesizes reports from BerriAI, StepSecurity, Wiz, and Socket to reconstruct the incident: the attacker used the GitHub CLI OAuth tokens of three developers, used an organization owner token to disable branch protection, switched the build source to the twin repository Berri-AI/litellm, which differs by only one hyphen, passed manual approval and cleared run records, taking about one and a half hours from the first change to release. During the infection window, the PyPI package was live for about 1 hour 45 minutes and the Docker floating tag for about 2 hours 30 minutes; versions 1.106.x and earlier and 1.107.0rc1/rc2 were not affected. The article ends with troubleshooting commands, a credential rotation checklist, and seven supply chain protection lessons.
The article reconstructs the complete timeline of how the attack succeeded in the hardened release pipeline, and summarizes transferable supply chain protection lessons, such as signatures only proving provenance and temporary privilege escalation being the most dangerous.