LiteLLM 1.107.0 on PyPI and Docker was compromised with a credential stealer

A hijacked LiteLLM release pipeline published a malicious v1.107.0 to PyPI and Docker on October 21; affected users should clean up and rotate keys.

LiteLLM's release pipeline was compromised on October 21, and a malicious litellm==1.107.0 shipped to PyPI and Docker registries, according to LiteLLM's incident post. It was live on PyPI from 11:39 to 13:23 UTC. Docker tags v1.107.0, latest, main-latest and main-stable served it from 11:46 to 14:20 UTC, so a proxy on a floating tag could have pulled it without anyone choosing 1.107.0. LiteLLM says enterprise customers on its private registry weren't affected.

The release drops cook.pth, cook.py and sitecustomize.py into site-packages, so the malware runs whenever Python starts, even if LiteLLM is never imported, per Datadog Security Labs. Datadog says it targets cloud, developer, AI-tool, browser and LiteLLM proxy credentials. Wiz counts roughly 49,000 downloads from ClickPy data. Help Net Security reports that Wiz saw the attacker testing stolen AWS credentials about four and a half hours after exfiltration.

LiteLLM's cleanup guidance:

• Check with pip show litellm and search for litellm-1.107.0.dist-info, cook.pth and sitecustomize.py. Not finding them doesn't prove you're clean.
• Don't start with pip, because any Python start reruns the payload. Delete the payload files and matching .pyc files from the shell, and kill the daemon holding /tmp/remote_code_loader.lock.
• Reinstall pinned to 1.106.2, or better, rebuild from scratch.
• Rotate the instance IAM role, every provider key in the proxy DB, the master and virtual keys, the DATABASE_URL password, and any secret in the host's environment.

LiteLLM says the attacker used stolen GitHub CLI OAuth tokens to run its release workflow against a lookalike repo, Berri-AI/litellm. It believes the tokens came from the logs of an internet-exposed internal LiteLLM deployment. It also says Claude Code can sometimes embed those tokens in response bodies that then get logged. LiteLLM hasn't confirmed how the attacker got into that deployment.

Sources

• Contained: Oct 21, 2026 LiteLLM release v1.107.0 Compromised · docs.litellm.ai
• LiteLLM supply chain compromise: What you need to know | Datadog Security Labs · Datadoghq
• LiteLLM hit by second supply chain attack this year, users urged to rotate credentials - Help Net Security · Help Net Security
• LiteLLM Compromised, Steals Credentials | Wiz Blog · Wiz.io