LiteLLM 1.107.0 Hacked: Credential Stealer Shipped on PyPI
Attackers hijacked LiteLLM 1.107.0 on PyPI with a credential stealer and remote backdoor. The malicious release stayed live for two hours before removal.
LiteLLM, a Python library used by millions of developers to talk to AI models like OpenAI, Anthropic and Google Gemini, was hit by a supply chain attack. Attackers published a malicious version 1.107.0 that quietly stole credentials from any machine where Python started. Here is what happened and what to do about it.
What happened
On October 21, 2026, attackers published a malicious release of LiteLLM, version 1.107.0, to PyPI, the main Python package repository. The bad release was also pushed to LiteLLM's official Docker images. It stayed live for about two hours before being removed. PyPI quarantined the package within hours, and the malicious Docker images were taken down the same day. LiteLLM gets about 23 million downloads a week, so even a short window put many developers at risk.
How the attack worked
LiteLLM's security director said the attackers used stolen GitHub CLI OAuth tokens from three engineers' accounts. One account triggered the project's release workflow, and another account approved it. The malicious build ran against a lookalike fork named Berri-AI/litellm, which differs from the real BerriAI/litellm fork by a single hyphen, a detail meant to fool human reviewers. Because it went through the normal release channels, the poisoned build carried seemingly legitimate build provenance.
What the malware steals
The malicious package installs a credential stealer, called privcollect by some researchers, plus a remote access backdoor. It abuses Python's startup files, cook.pth and sitecustomize.py, so the code runs every time Python starts, even if you never import LiteLLM. That means pip installs, IDE tools and CI jobs can all trigger it. It harvests cloud credentials for AWS, GCP and Azure, SSH, GPG and TLS keys, browser passwords and cookies, environment variables, AI tool auth files, and even rows from the LiteLLM Proxy's own credential tables. The stolen data is sent to www.litellm.dev, a lookalike domain unrelated to the official litellm.ai. The backdoor also polls a GitHub repository every hour for new commands to run.
Who is at risk
Anyone who installed or ran litellm 1.107.0 from PyPI, or pulled the official Docker images with the v1.107.0, latest, main-latest or main-stable tags on October 21, should assume their secrets were stolen. The seven PyPI wheels were all affected. Security researchers warn that simply uninstalling the package is not enough. The malicious files sit at the root of the Python site-packages folder and survive removal, so a running backdoor keeps going after uninstall.
What to do right now
First, check your lockfiles, package caches and running containers for version 1.107.0 and pin the safe release 1.106.2 by hash. Then look for cook.pth, cook.py and an unexpected sitecustomize.py in your site-packages, plus marker files like /tmp/.pc_once_* and /tmp/remote_code_loader.lock. Remove those files, kill any running loader process, rebuild the affected environment, and rotate every credential the machine could see - API keys, cloud tokens, database passwords and CI secrets included.
A repeat of an earlier attack
This is the second supply chain compromise of LiteLLM in 2026. In March, versions 1.82.7 and 1.82.8 were compromised through a stolen PyPI token, an incident linked to TeamPCP activity. Researchers say no connection between the two incidents has been established so far.
Sources
- Datadog Security Labs - https://securitylabs.datadoghq.com/articles/litellm-compromised-pypi-docker/ - The Hacker News - https://thehackernews.com/2026/10/litellm-compromised-in-supply-chain.html - Upwind - https://www.upwind.io/feed/litellm-1-107-0-supply-chain-attack-malicious-code-found-in-pypi-package - Kodem Security - https://www.kodemsecurity.com/resources/litellm-supply-chain-attack-litellm-1-107-0-affected-versions-iocs-and-first-hour-response-runbook