LiteLLM suspects the malicious package release originated from a GitHub token leaked in AI gateway logs
LiteLLM Suspects GitHub Token Leak in AI Gateway Logs Behind Malicious Package Release
Attackers hijacked the LiteLLM release pipeline and on October 21, 2026 pushed malicious version v1.107.0 containing a credential stealer and backdoor to PyPI, Docker Hub, and GHCR. Users who downloaded an unpinned version via pip between 11:39 and 13:23 UTC, or used an affected Docker image between 11:46 and 14:20, were affected. The malicious version loads cook.py via cook.pth, runs privcollect to steal and exfiltrate system, browser, developer, cloud, and AI tool secrets, and sitecustomize.py fetches a C2 domain from GitHub every hour and downloads and executes a second-stage payload. Wiz observed stolen AWS credentials being validated and enumerated approximately 4.5 hours after exfiltration, with calls including bedrock:ListFoundationModels, consistent with LLMjacking characteristics.
The article outlines the chain in which attackers used GitHub credentials leaked in logs to hijack the LiteLLM release pipeline; affected users can check themselves against the disclosed time windows and remediation recommendations.