Science & Tech · Cybersecurity · 2 hrs ago
Malicious LiteLLM 1.107.0 release stole credentials and installed a backdoor
LiteLLM version 1.107.0 was compromised in a software supply chain attack, with the malicious release distributed through PyPI and Docker.
LiteLLM is an open-source tool used to connect applications with AI services such as OpenAI, Anthropic and Google Gemini.
The malware could start when Python launched, stealing cloud, AI and other credentials as well as browser data and private keys.
It also installed a backdoor that could contact attackers and run commands on affected machines.
PyPI quarantined the package and Docker images were removed, but the scale of the attack is not yet known.
LiteLLM said the attack involved stolen tokens linked to three engineers’ GitHub accounts, and that the tokens have been revoked; its investigation is ongoing.
Anyone who ran version 1.107.0 should replace exposed credentials from a clean environment and check affected systems; version 1.106.2 was identified as the latest safe release.
LiteLLM version 1.107.0 was compromised and distributed with malware designed to steal credentials and install a backdoor.
The release was distributed through PyPI and Docker images, which have since been quarantined or removed.
The malware can collect cloud, AI, browser and developer credentials, as well as private keys and other sensitive data.
LiteLLM said the incident is under investigation and that three engineers’ GitHub accounts were used to publish the release.
Users who ran the compromised version are advised to revoke exposed credentials and use a clean environment to replace them.
- Who
- Users of LiteLLM 1.107.0 were affected. The attacker’s identity is not stated.
- What
- A compromised release delivered a credential stealer and a backdoor.
- When
- The malicious version was uploaded at 11:39 UTC on Wednesday, October 21, 2026.
- Where
- The release was distributed through PyPI and Docker registries.
- Why
- The malware was designed to steal credentials and other sensitive data and to run commands on affected machines.
This story does not have two clearly opposing sides.
An earlier LiteLLM compromise potentially exposed more than 2,500 organizations and 434,000 CI/CD pipelines, according to CloudSEK.
The malicious LiteLLM 1.107.0 version was uploaded.
PyPI quarantined the compromised version, and the malicious Docker image was removed from Docker Hub and GHCR soon after.
LiteLLM said its investigation was ongoing and that it had revoked the tokens involved in the attack.
- Affected release
- LiteLLM 1.107.0
- Latest safe version
- v1.106.2
- Reported upload time
- 11:39 UTC
- GitHub accounts involved
- Three engineers’ accounts, according to LiteLLM
- LiteLLM weekly downloads
- About 23 million
3 sources
What people are saying
We have identified that the malicious actions were taken through three engineers' GitHub accounts, appearing to be by way of stolen GitHub CLI OAuth tokens
We have not yet identified the mechanism by which the threat actor acquired the relevant tokens, so cannot yet assert that no further access to these GitHub accounts.
Check for /tmp/.pc_once_* (the exfil has already fired if this file exists) and /tmp/remote_code_loader.lock (the C2 daemon ran or is still running if this file exists)
Teams using 1.107.0 should stop deploying it and investigate environments where Python ran after installation, including proxy containers and CI runners