LiteLLM 1.107.0 Was Malware: Poisoned AI Package Stole Credentials

Attackers published a malicious version 1.107.0 of LiteLLM, a popular open-source Python library that lets apps talk to many AI models through one interface, on the PyPI package index and on Docker image registries on Wednesday, 21 October. The poisoned PyPI release was live from 11:39 to about 13:23 UTC (5:09 pm to 6:53 pm IST). LiteLLM said the release “steals credentials and loads remote-code execution tools”, and that earlier versions are safe.

Stolen GitHub Tokens Opened the Release Pipeline

In its incident report, LiteLLM said the attackers used the GitHub accounts of three of its engineers, apparently through stolen GitHub CLI login tokens. One account changed the release workflow and started the release, a second approved the production step, and a third deleted workflow records, which limited the logs available to investigators. The malicious packages were built from a repository the attackers controlled; the official 1.107.0 source code on GitHub does not contain the bad files.

Docker Hub tags including latest and main-stable pointed to the compromised image from 11:46 to 14:20 UTC, and the GitHub Container Registry copies were pulled by 13:51 UTC. LiteLLM said it has not yet found how the tokens were stolen, so further access cannot be ruled out.

Cloud Keys, SSH Keys and AI Tool Logins Targeted

Security firm Socket said the malware hunted for cloud and deployment credentials for AWS, Azure, Google Cloud, Kubernetes and Docker; Git, npm and PyPI credentials; SSH, GPG and TLS private keys; .env files; login files for AI coding tools; and saved passwords and cookies from Chrome-based browsers and Firefox. Where a LiteLLM proxy database was set up, it also read the stored model provider keys. LiteLLM is downloaded about 23 million times a week, Socket said, though that is the package’s normal popularity, not a count of infected installs.

Pin to 1.106.2, Then Rotate Every Secret

LiteLLM told affected users not to run pip install first, because any Python start in an infected environment re-runs the malicious files. Instead, users should delete cook.pth, cook.py and sitecustomize.py from site-packages, stop the background Python process holding /tmp/remote_code_loader.lock, and reinstall pinned to version 1.106.2, ideally by rebuilding the environment from scratch. If 1.107.0 ran on a machine with internet access, users should assume data was stolen and rotate every key and password it could reach.

The attack came on the same day the hosting platform Railway disclosed a breach of customer secrets. More reports are in Daily Updates.

Source: LiteLLM incident report, 21 October 2026. Also based on reporting by Socket.

Image: Socket.