LiteLLM 1.107.0 poisoned again: malware slipped through official release approval to steal credentials

LiteLLM 1.107.0 was found to contain credential-stealing malware and a remote code execution mechanism; the malicious package was distributed via PyPI and Docker repositories on October 21, 2026, and the maintainers said they had removed the affected artifacts and contained the incident. This is the second compromise of LiteLLM after March of the same year. According to the official report, the attack abused the GitHub credentials of three engineers, branch protection was overridden by a privileged account, and the malicious artifact was released through the formal approval process; the artifact was built from the hyphenated Berri-AI/litellm repository, and the official source tag contained no malicious files. GMO Flatt Security's analysis said the malicious wheel placed files such as cook.pth in site-packages and ran via Python's startup mechanism, so programs that do not import LiteLLM may also be affected; it can steal cloud credentials, SSH private keys, browser data, and credentials for development tools such as Codex, Claude and Gemini.