LiteLLM 1.107.0 compromised, implanted with credential stealer and backdoor
Start here
2026 年 10 月 21 日，攻击者经入侵的发布流水线把带毒的 litellm==1.107.0 发布到 PyPI 并推送官方 Docker Hub 与 GHCR 镜像，恶意版本在 PyPI 存活约两小时（11:39–13:23 UTC）后被隔离下架，官方称受影响构建已移除、事件已遏制，安全版本为 v1.106.2；Socket 扫描器在发布 7 分钟后标记全部 7 个 wheel。全部 7 个平台 wheel 经 pyproject.toml 中 maturin 的 data 指令把 cook/ 目录打进包，安装后向 site-packages 写入 cook.pth、cook.py、sitecustomize.py，任何 Python 进程启动即触发，无需导入 litellm；privcollect 窃取器收集 AWS、Azure、GCP 等云凭据、SSH/GPG 私钥、浏览器密码、CI/CD 密钥、20 多个 AI 编码工具（Codex、Claude、Gemini、Cursor 等）的认证文件及 LiteLLM 代理数据库凭据，加密上传攻击者基础设施，后门每小时轮询攻击者服务器下载执行代码。源码仓库、Git 标签与 sdist 不含恶意文件，仅审源码会漏掉 wheel 恶意行为。该包周下载约 2300 万、过去一个月超 9200 万，UTC 11:39–13:23 经 pip 下载未固定版本或 11:46–14:20 使用受影响 Docker 镜像（v1.107.0、latest、main-latest、main-stable 标签）的用户受影响；Wiz 观测到失窃凭据开始被滥用，最初与 LLMJacking 相关。官方披露攻击经三名工程师的 GitHub CLI OAuth 令牌驱动，特权账号关闭分支保护，构建被重定向到仅差一个连字符的仿冒仓库 Berri-AI/litellm，带毒产物经正式审批与官方签名发布；LiteLLM 怀疑一个对公网暴露、记录 Claude Code 会话的内部网关日志泄露了开发者 GitHub 凭据。根因分析显示：5 月 27 日含 Agent Platform 主密钥的配置文件被误提交公开仓库，密钥标记撤销但从未执行，10 月 10 日攻击者用它换取 GitHub 组织所有者令牌，并以恶意 CI 工作流窃取 CI 密钥（早于投毒 11 天），最终实施发布劫持。这是 LiteLLM 继 2026 年 3 月 1.82.7/1.82.8 后第二次供应链投毒，CERT-In 发布通报 CIAD-2026-0053。
Generated by AI from reports · Updated 19 hr ago
Latest developments
- · 1 reportMalicious workflow was already stealing secrets 11 days before the LiteLLM supply chain attack
- · 3 reportsLiteLLM release was compromised in version 1.107.0
- · 1 reportLiteLLM 1.107.0 suffers supply chain poisoning
- · 1 reportLiteLLM supply chain incident exploited by attackers to steal credentials
- · 23 reportsMalicious LiteLLM version 1.107.0 implanted with credential-stealing program
Progress timeline
- ХабрSelectedInfostealer and backdoor found in LiteLLM version 1.107.0
On October 21, 2026, the release pipeline of the AI gateway LiteLLM was compromised, and within hours PyPI, Docker Hub, and GHCR distributed version 1.107.0 containing infostealers and backdoors. The attackers did not modify the official repository's code; instead, they redirected the build to the impersonating repository Berri-AI/litellm, which differs by only one hyphen, causing the malicious package to be released under the official signature; according to LiteLLM's analysis, the entry point was a platform master key that had remained unrevoked since it leaked in May. The article recommends confirming whether 1.107.0 was ever run, deleting the malicious files and rebuilding the environment on 1.106.2, rotating all kinds of keys from a clean host, and pinning versions and hashes and switching to short-lived tokens.
- WebZenn Security (Japanese)· Media coverageCan keys be stolen just by pip install? The mechanism of the LiteLLM 1.107.0 hijacking and how to deal with it(opens the original post in a new tab)
- WebAI Threat Watch (aithreat.io)· Media coverageLiteLLM supply chain attack started with an exposed master key(opens the original post in a new tab)
- CSA Labs ResearchSelectedLiteLLM 1.107.0: an unrevoked agent key escalates into a release hijack
On October 21, 2026, attackers published the malicious litellm==1.107.0 to PyPI and pointed the official LiteLLM Docker Hub and GHCR tags to a poisoned image; the malicious wheel remained on PyPI until 13:23 UTC. According to LiteLLM's October 23 attack chain disclosure, the root cause was that the master key of an agent platform experimental deployment on May 27 was committed to a public repository; the team overwrote the commit but did not revoke the key, and four and a half months later the attackers used that key to call the agent platform API, exchanging it for an unscoped-permission CLI OAuth token belonging to a GitHub organization owner, then collected maintainer tokens, overwrote branch protection and hijacked the release pipeline. Microsoft and StepSecurity found that the payload runs on every Python startup, collects credentials for cloud, developer, AI tools, browsers and the LiteLLM proxy database, and on Unix hosts also starts a detached daemon that polls remote code hourly.
- WebAI Threat Watch (aithreat.io)· Media coveragePopular AI tool LiteLLM says unrevoked key allowed hackers to target users(opens the original post in a new tab)
- ХабрSelectedLiteLLM 1.107.0 incident analysis: how the release pipeline was compromised and why signing failed to protect
On October 21, 2026, litellm==1.107.0 on PyPI was implanted with credential-stealing code, and the Docker image with the same tag was also infected. This is the second supply chain incident within a year for the open-source LLM gateway LiteLLM, following the compromise of 1.82.7/1.82.8 in March 2026. The author synthesizes reports from BerriAI, StepSecurity, Wiz, and Socket to reconstruct the incident: the attacker used the GitHub CLI OAuth tokens of three developers, used an organization owner token to disable branch protection, switched the build source to the twin repository Berri-AI/litellm, which differs by only one hyphen, passed manual approval and cleared run records, taking about one and a half hours from the first change to release. During the infection window, the PyPI package was live for about 1 hour 45 minutes and the Docker floating tag for about 2 hours 30 minutes; versions 1.106.x and earlier and 1.107.0rc1/rc2 were not affected. The article ends with troubleshooting commands, a credential rotation checklist, and seven supply chain protection lessons.
- iThome (Taiwan)SelectedLiteLLM publishes follow-up investigation of supply chain attack; key leaked in May let hackers manipulate the official release process
LiteLLM公布1.107.0版供应链攻击的调查结果，攻击者利用5月泄露后未撤销的Agent Platform主密钥取得GitHub组织所有者权限，操控官方发布流程，让含窃密程序的版本上架PyPI及容器镜像仓库。5月团队误将实验性Agent Platform的配置文件提交至公开GitHub仓库，虽强制推送覆盖提交并发现密钥需撤销，但未实际撤销；10月10日攻击者用该密钥调用Agent Platform API，从返回的AI代理配置中取得一名组织所有者的CLI OAuth令牌，再借新增的GitHub Actions工作流程在CI环境外泄另外两名维护者的GitHub令牌并删除执行纪录。LiteLLM通过提交标识符与GitHub审计日志还原攻击过程，修正了先前怀疑令牌从内部服务日志外泄的说法；受影响版本已于10月21日下架，团队正全面撤销内部系统及外部服务的相关凭据。
- WebZenn Security (Japanese)· Media coverageLiteLLM 1.107.0 malware — what AI developers should check in 5 minutes, and the setting to wait 3 days from now on(opens the original post in a new tab)
- RedditReddit r/AIDangers· DiscussionLeaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline(opens the original post in a new tab)
- CSA Labs ResearchSelectedThe unrevoked key: from agent credentials to LiteLLM release hijacking
2026年10月21日，携带凭据窃取载荷的 litellm==1.107.0 被发布到 PyPI 和 LiteLLM 官方 Docker Hub 与 GHCR 镜像，这是 LiteLLM 2026年内第二次供应链投毒。CSA 依据 LiteLLM 的攻击链披露梳理：一枚 5月27日提交到公开仓库、从未撤销的 Agent Platform master key 在 10月10日被用于调取内部 API，返回一位 GitHub 组织所有者的 CLI OAuth token；攻击者借此在11天里收集多名维护者 token，关闭分支保护并把发布工作流指向仿冒仓库 Berri-AI/litellm，由正规管道构建、签名并发布了带有效溯源的恶意制品。载荷在每次 Python 启动时运行窃取器，转储代理数据库中的上游提供商密钥，并启动每小时轮询远程代码的守护进程。
- WebAI Threat Watch (aithreat.io)· Media coverageHackers Breached LiteLLM GitHub Repository 11 Days Before Supply Chain Attack(opens the original post in a new tab)
- X@ralphsaw226· Discussionhttps://docs.litellm.ai/blog/security-incident-oct-21-2026(opens the original post in a new tab)
- X @wunderwuzzi23SelectedLiteLLM discloses intrusion details: leaked key not revoked, ultimately leading to backdooring of release
LiteLLM published an investigation into the attack chain involved in the backdooring of the v1.107.0 release, and researcher Johann Rehberger summarized several key points. The key used to backdoor LiteLLM was accidentally leaked on May 27, 2026; the leak was discovered internally, but the key was never revoked, and the author says the attacker appears to have obtained it as well. On October 10, the attacker used the key to further gain GitHub credential access, ultimately breaching LiteLLM's release process and implanting a backdoor. More than 4 months passed from the key leak to its exploitation.
- SocketSelectedNew evidence shows LiteLLM credential-stealing workflow ran successfully 11 days before the supply chain attack
The Socket threat research team found that a malicious workflow in the BerriAI/litellm repository that stole CI secrets had already run successfully as early as October 10, 2026, 11 days before the October 21 supply chain attack that published the malicious litellm==1.107.0 artifact. Using the commit message ci: bump cache config, the attacker added the malicious workflow twice on a short-lived branch created and deleted that same day, stealing 6 organization-level secrets including GH_TOKEN and a GitHub App private key on October 10, and another 14 secrets on October 12, for a total of 20 across the two rounds, which were base64-encoded and sent to webhook.site; the repository activity logs attribute these operations to the account ishaan-berri. Socket stated that it cannot confirm whether October 10 was the earliest compromise, how the credentials were stolen, or whether the collection endpoint actually received the data.
- LiteLLMSelectedThe attack chain behind the LiteLLM v1.107.0 release incident
LiteLLM published a root cause analysis reconstructing the full attack chain of the malicious version litellm==1.107.0. On May 27, 2026, a configuration file containing the Agent Platform master key was committed to a public repository; the key was flagged for revocation but was not revoked. On October 10, the attacker used the master key to extract the GitHub CLI OAuth token of the GitHub organization owner from the API, gaining owner-level access, and then used an internal repository's CI workflow to exfiltrate the tokens of two maintainers to webhook.site. On October 21, the attacker bypassed branch protection, pointed the release source to a fork of the impersonating organization Berri-AI, used the stolen tokens to trigger and approve a production release, and 7 malicious wheels were published to PyPI, with Docker Hub and GHCR images published afterward; the attacker also deleted run records and force-pushed to clean up history.
- WebAI Threat Watch (aithreat.io)· Media coverageInside the LiteLLM 1.107.0 supply chain compromise: Credential theft through Python startup hooks(opens the original post in a new tab)
- CSA Labs ResearchSelectedLiteLLM 1.107.0: when model gateway logs become a credential store
On October 21, 2026, a malicious build of LiteLLM 1.107.0 was published to PyPI, Docker Hub, and GHCR, containing a credential stealer and a remote code loader. LiteLLM says the attacker used the GitHub CLI OAuth tokens of three engineers to drive the release pipeline, and suspects that an internal deployment exposed to the public internet logged the request and response bodies of Claude Code sessions, leaving developer GitHub credentials unrelated to model access in the gateway logs. The malicious wheel adds cook.pth, cook.py, and sitecustomize.py, which can execute when any Python process starts; the stealer uses Prisma to export LiteLLM's credential table and model table when DATABASE_URL is set. Wiz says the stolen AWS role credentials were used to enumerate Bedrock models after about 4.5 hours.
- WebAI Threat Watch (aithreat.io)· Media coverageLiteLLM Compromised in Fresh Supply Chain Attack(opens the original post in a new tab)
- WebBoannews (Korea)· Media coverageAI 개발 도구 라이트LLM, 악성코드 감염에 '비상'…AWS·클로드 계정정보 탈취 위험(opens the original post in a new tab)
- CERT-InSelectedLiteLLM's PyPI package and Docker images compromised
CERT-In issued security advisory CIAD-2026-0053, stating that the PyPI package for LiteLLM 1.107.0 and the Docker images hosted on GHCR and Docker Hub suffered a supply chain compromise. According to the incident analysis cited in the advisory, attackers used the impersonating repository Berri-AI/litellm to trigger the release process, modified pyproject.toml, and injected cook.pth, cook.py and sitecustomize.py into the Python site-packages, leveraging the interpreter startup mechanism to execute code without the application explicitly importing LiteLLM. The advisory recommends checking hosts that installed this version and environments that pulled the related images, rebuilding containers from verified clean images, and rotating related credentials, listing 1.106.2 as a clean version.
- The Hacker NewsSelectedLiteLLM suspects the malicious package release originated from a GitHub token leaked in AI gateway logs
Attackers hijacked the LiteLLM release pipeline and on October 21, 2026 pushed malicious version v1.107.0 containing a credential stealer and backdoor to PyPI, Docker Hub, and GHCR. Users who downloaded an unpinned version via pip between 11:39 and 13:23 UTC, or used an affected Docker image between 11:46 and 14:20, were affected. The malicious version loads cook.py via cook.pth, runs privcollect to steal and exfiltrate system, browser, developer, cloud, and AI tool secrets, and sitecustomize.py fetches a C2 domain from GitHub every hour and downloads and executes a second-stage payload. Wiz observed stolen AWS credentials being validated and enumerated approximately 4.5 hours after exfiltration, with calls including bedrock:ListFoundationModels, consistent with LLMjacking characteristics.
- LavX NewsSelectedMalicious LiteLLM 1.107.0 version steals credentials and implants a remote access trojan
On Wednesday, attackers published a malicious LiteLLM 1.107.0 version through PyPI and a Docker repository, bundling an infostealer and a remote access trojan, and security teams subsequently quarantined the package. The malicious code was implanted through commits to a counterfeit GitHub repository, Berri-AI/litellm, in cook.pth, cook.py and sitecustomize.py, of which sitecustomize.py loads when the Python interpreter starts and polls the attacker infrastructure every hour awaiting instructions. The stealer reads credentials and cookies from Chrome, Firefox, Edge and Safari, AWS, GCP and Azure cloud credentials, and API keys from vendors including OpenAI, Anthropic and Cohere, as well as SSH private keys, encrypts them and POSTs them to www[.]litellm[.]dev/healthcheck.
- XenoSpectrumSelectedLiteLLM 1.107.0 poisoned again: malware slipped through official release approval to steal credentials
LiteLLM 1.107.0 was found to contain credential-stealing malware and a remote code execution mechanism; the malicious package was distributed via PyPI and Docker repositories on October 21, 2026, and the maintainers said they had removed the affected artifacts and contained the incident. This is the second compromise of LiteLLM after March of the same year. According to the official report, the attack abused the GitHub credentials of three engineers, branch protection was overridden by a privileged account, and the malicious artifact was released through the formal approval process; the artifact was built from the hyphenated Berri-AI/litellm repository, and the official source tag contained no malicious files. GMO Flatt Security's analysis said the malicious wheel placed files such as cook.pth in site-packages and ran via Python's startup mechanism, so programs that do not import LiteLLM may also be affected; it can steal cloud credentials, SSH private keys, browser data, and credentials for development tools such as Codex, Claude and Gemini.
- GIGAZINESelectedAI tool LiteLLM found to have embedded password-stealing malicious program; installation alone may affect other Python programs
Version 1.107.0 of the open-source AI tool LiteLLM, published to PyPI on 21 October 2026, was implanted with an infostealer and backdoor and was taken down about two hours later. An investigation by the security company SafeDep found that all 7 distribution packages for Windows, macOS and Linux contained malicious files, while the source code in the official GitHub repository did not. The malicious program executes via a .pth file that Python automatically loads at startup; it is triggered whenever Python is started in the same environment, without any need to use LiteLLM, and steals passwords and browsing history saved in browsers, SSH private keys, cloud service credentials, and credentials for AI development tools such as Claude Code, Cursor and GitHub Copilot, as well as API keys managed by LiteLLM, encrypts them and sends them to an external server, www.litellm.dev; another file also contains a backdoor that fetches a target server from GitHub every hour and downloads and executes a program prepared by the attacker.
- X @wunderwuzzi23Attackers continue to attack LiteLLM
Attackers continue to attack LiteLLM; Wiz says it has begun observing abuse of stolen credentials, initially related to LLMJacking. Researcher Johann Rehberger (@wunderwuzzi23) cited Wiz's update and made the above judgment, while linking his previously written analysis article explaining why he believes LiteLLM was targeted (https://embracethered.com/blog/posts/2026/hijacking-litellm-for-fun-and-profit/）。Wiz indicates that its crawler discovered this supply chain incident on the morning of that day, US Eastern Time, and has continued to update and track it since, having observed credential abuse activity from two IPs, 168.100.8[.]57 and 165.227.201[.]8.
- ХабрSelectedLiteLLM 1.107.0 credential stealer: how to check yourself and what needs to be replaced
On October 21, 2026, litellm==1.107.0 on PyPI had a credential stealer implanted in all binary wheel files, and the Docker images tagged v1.107.0 were also infected; tags such as latest pointed to the infected image for about three hours; the version was uploaded at 11:39 UTC and removed from PyPI at 13:23, and 1.106.x and below are clean versions. According to StepSecurity's analysis, the stealer writes cook.pth, cook.py and sitecustomize.py into site-packages, runs on every Python startup without needing to import litellm, steals SSH and cloud keys, .env, environment variables and AI tool tokens, and if DATABASE_URL is set, also dumps the proxy database containing vendor API keys, encrypts it and sends it to litellm.dev.
- The Hacker NewsSelectedLiteLLM hit by supply chain attack, implanted with credential stealer and backdoor
The popular Python package LiteLLM suffered a supply chain attack: version 1.107.0 was implanted with a credential stealer and backdoor when distributed via PyPI wheel and Docker images. The package has now been quarantined on PyPI, and the malicious Docker images have been removed. SafeDep, Socket, StepSecurity and Upwind reported the incident. LiteLLM security lead Oliver Jensen said the malicious operations were carried out through the GitHub accounts of three engineers, suspected to have exploited stolen GitHub CLI OAuth tokens, using one account to trigger the release process and another to approve it; all related tokens have been revoked, and the mechanism by which the attackers obtained the tokens has not yet been determined. Users who have downloaded this version are advised to revoke and replace exposed credentials in a clean environment and to pin to version 1.106.2 using the digest.
- iThome (Taiwan)SelectedLiteLLM engineer GitHub credentials stolen; official release process becomes a distribution channel for malicious programs
Hackers used stolen engineer GitHub credentials to tamper with the official release process of the open-source AI model chaining tool LiteLLM, causing version 1.107.0 to be implanted with an infostealer and a remote code execution backdoor, distributed via PyPI and a Docker image repository. The investigation found that the attackers obtained the credentials of 3 engineers, used an account with administrative privileges to disable code protection measures, and changed the location from which the release system reads source code to a similarly named impersonation repository; the 1.107.0 source code publicly available on GitHub does not contain the malicious files. SafeDep's analysis found that the contaminated package adds malicious files to the Python environment, and that other programs in the same environment may also trigger the theft when they start, collecting cloud service credentials, AI service keys, remote login private keys, and keys in the LiteLLM database and exfiltrating them.
- Mend.ioSelectedLiteLLM 1.107.0 on PyPI compromised, carrying a credential stealer and code loader
LiteLLM 1.107.0 was published to PyPI as a malicious version on October 21; all seven wheels planted cook.pth, cook.py and sitecustomize.py in the site-packages root directory, causing a credential stealer to run as soon as Python started. PyPI quarantined the version within two hours, and the maintainers removed the malicious Docker image of the same version at 14:32 UTC, while the package had been downloaded more than 92 million times over the past month. The attacker added data = "cook" to the maturin configuration in pyproject.toml, packing the cook directory into the wheel, and rolled the version number back from 1.108.0 in the tag to 1.107.0; ten commits were submitted under the impersonating name Berri-AI, similar to the real organization name BerriAI, and were created via the GitHub web interface, thus carrying the Verified badge.
- OX SecurityLiteLLM 1.107.0 was implanted with an information stealer and RAT
On October 21, 2026, the maliciously implanted LiteLLM 1.107.0 was published to PyPI, and PyPI has quarantined that version. The malicious code was injected only into the wheel package, making anomalies difficult to find when reviewing the source repository; as long as the package is installed, every Python startup triggers it even if the project does not use LiteLLM. The malware has both information-stealing and RAT functionality, stealing LLM provider API keys, cloud credentials, environment variables, and credentials in the LiteLLM proxy database; targets include AWS and Azure keys, GitHub credentials, and data from AI tools such as Claude Code, GitHub Copilot, and Cursor, and the stolen content is sent to the attacker-purchased impersonation domain litellm[.]dev. This is the second time LiteLLM has been hijacked this year; the 1.82.7 and 1.82.8 versions in March this year were compromised in the TeamPCP campaign.
- Wiz ResearchSelectedLiteLLM compromised, malicious version steals credentials
Wiz Research disclosed that LiteLLM suffered a supply chain attack: the malicious version 1.107.0 was uploaded to PyPI on October 21 and steals browser, cloud and AI provider credentials; the latest secure version is v1.106.2. That version was quarantined by PyPI at 1:20 UTC, and the poisoned v1.107.0, latest, main-latest and main-stable images on GHCR and Docker Hub were also removed at around 13:53 UTC. The attacker pushed 10 commits through the impersonated organization repository Berri-AI/litellm between 08:56 and 10:46 UTC on October 21 to inject into the release process; Wiz said the payload abuses both .pth files and sitecustomize.py as persistence mechanisms, suspected to be the first such case in the wild, and shows clear signs of large language model-assisted development.
- SocketSelectedLiteLLM PyPI package and Docker image compromised, used to steal cloud and AI credentials
The PyPI package and Docker image of LiteLLM 1.107.0 were implanted with a credential stealer, and Socket's AI scanner flagged all 7 wheels 7 minutes after release. The malicious Python startup file activates as soon as the interpreter starts, without the application needing to import LiteLLM; it collects cloud credentials such as AWS, Azure, and Google Cloud, SSH and GPG private keys, browser data, and authentication files of AI tools such as Codex, Claude, Gemini, and Cursor, encrypts them, and exfiltrates them to www.litellm.dev/healthcheck; another loader pulls remote Python code from the GitHub repository letters9813/pythonclient-test for execution.
- LiteLLMSelectedContained: The October 21, 2026 LiteLLM v1.107.0 release was compromised
LiteLLM's release pipeline was compromised on October 21, and attackers pushed v1.107.0 containing credential-stealing and remote code execution malicious code to PyPI and Docker Hub; the official statement said affected builds have been taken down and the incident contained. The malicious litellm==1.107.0 was live on PyPI for about two hours (11:39 to 13:23 UTC), and the v1.107.0, latest, main-latest and main-stable tags on Docker Hub pointed to the contaminated image from 11:46 to 14:20 UTC; the official v1.107.0 source tag on GitHub does not contain the malicious files. Enterprise private versions were not affected, and the official recommendation is for open-source users to pin the version to 1.106.2 and rotate reachable credentials such as IAM roles, provider keys and DATABASE_URL passwords.
- SafeDepSelectedLiteLLM 1.107.0 on PyPI was implanted with a credential stealer and backdoor
The LiteLLM 1.107.0 release package on PyPI was implanted with a credential stealer and a remote code execution backdoor; wheels for seven platforms all write three files into site-packages, which are loaded when any Python process starts, even without importing litellm. The stealer collects SSH keys, cloud credentials, CI/CD secrets, browser passwords and AI tool tokens, encrypts them and uploads them to www.litellm[.]dev; the backdoor reads a server address hourly from the attacker's GitHub file, downloads and executes code. LiteLLM's incident report says the attacker held the GitHub CLI credentials of three developers, bypassed branch protection and pointed the release process to a lookalike repository Berri-AI/litellm, then used a second developer's credentials to pass the approval gate. GitHub account letters9813 returned 404 at 13:40 UTC, after which the backdoor could no longer find the server address.
- Datadog Security LabsSelectedLiteLLM hit by supply chain attack: what you need to know
On October 21, 2026, attackers published a malicious version 1.107.0 of the LLM agent library litellm (about 23 million weekly downloads), which was on PyPI and the official Docker image for about two hours before being removed. This version wrote cook.pth, cook.py, and sitecustomize.py into site-packages, triggered whenever any Python process started, even if LiteLLM was never imported; the payload stole cloud platform credentials, SSH keys, LLM provider API keys, sessions of AI coding tools such as Claude, Codex, and Cursor, browser passwords, and LiteLLM proxy database credentials, encrypted them and sent them to the impersonating domain www.litellm[.]dev, and included a second-stage RAT backdoor that downloaded and executed code hourly from a domain read from a fixed GitHub file. It is recommended to manually delete the payload files, roll back to 1.106.2, and rotate all affected credentials.
- JFrog Security ResearchSelectedLiteLLM hijacked again: malicious 1.107.0 installation package steals credentials and loads remote code
The JFrog security research team found that all seven platform wheels of litellm 1.107.0 on PyPI were implanted with malicious code, and the official litellm/litellm:1.107.0 Docker image was also affected; PyPI and Docker Hub have removed the related artifacts. The source package does not contain these three malicious files, and reviewing only the source, Git tags, or sdist would miss the malicious behavior in the wheel. This is the second time LiteLLM has been hijacked in 2026, and JFrog says there is no evidence linking it to the March TeamPCP incident; LiteLLM said on October 22 that the incident was contained, and JFrog recommends discarding all 1.107.0 wheels, deleting the startup hook first, then rotating credentials and rebuilding the environment.
- Endor LabsSelectedLiteLLM 1.107.0 tampered with: Python startup hook steals cloud, AI, and agent credentials
litellm==1.107.0, released on October 21, 2026, was built from a source revision containing a credential stealer and remote code loader; PyPI subsequently quarantined that version, with the previous version being 1.106.2. The malicious change occurred only at the packaging layer: a line data = "cook" was added to the Maturin configuration in pyproject.toml, installing cook.pth, cook.py, and sitecustomize.py into site-packages, so that any Python startup in that environment triggers the payload. The collector contains 16 modules, reads cloud credentials and instance metadata, SSH/GPG/TLS private keys, browser passwords, login credentials for AI tools such as Claude, Codex, Gemini, Cursor, and Copilot, and queries the credential table and model configuration table in the LiteLLM proxy database, then encrypts and uploads them to www.litellm.dev/healthcheck.
- StepSecuritylitellm 1.107.0 poisoned on PyPI: backdoored wheels release a credential stealer and an hourly remote code loader
litellm 1.107.0, published to PyPI on October 21, 2026, had malicious code implanted in all 7 wheels, and the official LiteLLM Docker image carried the same payload. The payload runs automatically on every Python startup via .pth and sitecustomize, without needing to import litellm: the privcollect stealer collects browser passwords, SSH and GPG keys, cloud credentials, configurations of more than 20 AI coding tools, and provider API keys in the LiteLLM proxy database, encrypts them, and sends them back to the impersonated domain www.litellm.dev; another payload spawns a daemon that every hour reads an address from an attacker-controlled GitHub repository and executes the delivered Python code. The infected version was built from the impersonated repository Berri-AI/litellm, and the attacker layered ten commits on top of the clean v1.107.0 git tag.
- Aikido SecurityLiteLLM compromised: PyPI version 1.107.0 contains an infostealer and a remote access trojan
On October 21, 2026, version 1.107.0 of the open-source LLM agent LiteLLM was found on PyPI to have been injected with malicious code by attackers, and the official Docker image was also affected. The attackers used the data directive of maturin in pyproject.toml to package the cook/ directory created in the compromised build environment into the wheel; after installation, it runs automatically at Python startup through cook.pth, cook.py and sitecustomize.py. On first run, the infostealer steals browser-saved passwords, SSH private keys, AWS/Azure/GCP cloud credentials, CI/CD secrets, credentials for development tools such as Claude Code and Cursor, and the contents of the LiteLLM database, encrypts them with RSA-4096 and exfiltrates them; the remote access trojan fetches the C2 domain from a GitHub repository every hour and executes arbitrary code.
Related discussion
- X@silvanopuccini · Silvano Puccini6/8 · LiteLLM El artefacto 1.107.0 contenía malware. Si lo instalaste o ejecutaste: aislá el entorno, reconstruí desde…(opens the original post in a new tab)
1 comments·Oct 30 08:49Collect
- X@Leverlark · LeverlarkLiteLLM 1.107.0 shipped a credential stealer through its own release pipeline. A cook.pth file runs it at every Python…(opens the original post in a new tab)
1 comments·Oct 30 08:49Collect
- X@mykolamandra · Mykola Mandraon 21 October, version 1.107.0 of litellm shipped with a credential stealer inside litellm is the free gateway many fir…(opens the original post in a new tab)
1 likes · 1 comments·Oct 29 21:34Collect
- X@alex_cuciureanu · swappieLiteLLM's poisoned 1.107.0 on PyPI shipped an infostealer and a remote access trojan. It had about 49,000 downloads in…(opens the original post in a new tab)
1 comments·Oct 29 07:40Collect
- X@SagarGiri1707 · Sagar GiriThe Update You Trusted: How LiteLLM 1.107.0 Shipped a Credential Stealer On October 21, a Python package downloaded ab…(opens the original post in a new tab)
1 likes·Oct 29 21:34Collect
- X@dmshirochenko · Shirochenko Dmitriysource: https://docs.litellm.ai/blog/security-incident-oct-21-2026-attack-chain(opens the original post in a new tab)
- X@dmshirochenko · Shirochenko Dmitriylitellm's master key for its agent platform was committed to a public repo on may 27. it was never revoked. on oct 10…(opens the original post in a new tab)
3 comments·Oct 29 02:37Collect
- X@DFIR_Radar · DFIR RadarTrojanized LiteLLM 1.107.0 pushed to PyPI and Docker on Oct 21 hooks Python's startup routine to steal credentials befo…(opens the original post in a new tab)
5 likes · 3 comments·Oct 29 14:34Collect
- X@codevolt · HannahSource: https://docs.litellm.ai/blog/security-incident-oct-21-2026(opens the original post in a new tab)
- X@codevolt · HannahRemoving a bad Python package is not always enough. A poisoned release this month dropped a .pth file and https://sitec…(opens the original post in a new tab)
1 comments·Oct 29 02:37Collect
- X@pillespilles · pillespillesSources: LiteLLM's incident report https://docs.litellm.ai/blog/security-incident-oct-21-2026 and Microsoft's analysis…(opens the original post in a new tab)
- X@pillespilles · pillespillesYour AI app's weakest link isn't the model. It's the proxy in front of it. The LiteLLM 1.107.0 compromise ran at Python…(opens the original post in a new tab)
1 likes · 1 comments·Oct 30 08:49Collect
Attention trend
New sources per day
- Oct 21: 23 new sources (4 outlets, 19 accounts)
- Oct 22: 204 new sources (11 outlets, 193 accounts)
- Oct 23: 42 new sources (5 outlets, 37 accounts)
- Oct 24: 14 new sources (2 outlets, 12 accounts)
- Oct 25: 13 new sources (0 outlets, 13 accounts)
- Oct 26: 14 new sources (0 outlets, 14 accounts)
- Oct 27: 8 new sources (0 outlets, 8 accounts)
- Oct 28: 5 new sources (1 outlets, 4 accounts)
- Oct 29: 4 new sources (0 outlets, 4 accounts)
- Oct 30: 0 new sources (0 outlets, 0 accounts)