Image: Wikimedia Commons / Maćko, CC BY-SA 4.0 — Illustrative image: Python code on a terminal (LiteLLM is a Python package; no permitted official product photo in the primary sources)
📌 KEY HIGHLIGHTS
- Compromised release:
litellm==1.107.0on PyPI — all seven wheels (Windows, Linux, macOS) — live from 11:39:51 to 13:23 UTC on 21 October 2026; Docker Hub and GHCR imagesv1.107.0/latest/main-latest/main-stablecarried the same malware for roughly two to three hours (LiteLLM post-mortem, reported by BleepingComputer). - The payload: a credential stealer (
cook.pth→cook.py) that runs every time Python starts — even if you never import LiteLLM — plus a backdoor loader (sitecustomize.py) that re-downloads code hourly. Stolen data was encrypted and sent to a lookalike domain,litellm[.]dev. - How they got in: stolen GitHub CLI OAuth tokens from three LiteLLM engineers' accounts were used to fire the project's own release pipeline against a lookalike fork,
Berri-AI/litellm— one hyphen away from the realBerriAI/litellm— so the poisoned build shipped with apparently legitimate provenance (Datadog Security Labs). - Scale: LiteLLM is one of the most-installed Python AI packages in the world — about 92 million monthly downloads on PyPI and 61,800 GitHub stars (BleepingComputer); the maintainer lists NVIDIA, Netflix, AT&T and Okta as users. This is its second supply-chain compromise in 2026.
- Safe version: 1.106.2 is the latest clean release. Versions 1.107.0rc1 and rc2, plus companion packages
litellm-proxy-extras==0.4.110andlitellm-enterprise==0.1.78, are clean (LiteLLM, reported by SafeDep).
What happened?
LiteLLM is the open-source Python SDK and AI gateway that lets an app talk to OpenAI, Anthropic, Google Gemini and other providers through one common API. On 21 October 2026, attackers published a malicious version 1.107.0 of the package through LiteLLM's own release process. The malicious wheels sat on PyPI for roughly two hours before being quarantined, and the poisoned Docker images stayed on Docker Hub and GHCR for up to about two and a half hours.
The nastiness is in the delivery mechanism. The attacker did not touch LiteLLM's application code — only the installation package. Three files were planted in the Python library directory: cook.pth, cook.py and sitecustomize.py. Python processes executable .pth lines during interpreter startup, and then tries to import sitecustomize — so the malware fires before your application runs, every single time Python is launched in that environment. Socket's researchers found that even running Python or pip to investigate the installation triggered the payload, which is why the official guidance says to inspect affected environments without launching the interpreter.
The stealer went after the crown jewels: AWS, Azure and Google Cloud credentials, Kubernetes and Docker secrets, AI tool authentication files, LiteLLM proxy database keys, Git/GitHub/npm/PyPI/CI-CD tokens, .env files, SSH, GPG and TLS keys, browser logins, cookies, autofill data and history, environment variables, shell histories, and system and network details. The second file, sitecustomize.py, launched a detached loader that checks a GitHub-hosted pointer every hour and downloads fresh Python code for execution — a persistent backdoor even if the first exfiltration completed.
LiteLLM 1.107.0 supply chain attack — what to do: the check-and-clean checklist
| Step | What to do | Why / what it tells you |
|---|---|---|
| 1 | Check your installs: pip show litellm and your Docker image tags for exactly 1.107.0 | Only 1.107.0 wheels and the Docker/GHCR tags v1.107.0, latest, main-latest, main-stable from 11:46–14:20 UTC on 21 Oct are affected |
| 2 | Look for the malware markers without launching Python: /tmp/.pc_once_* and /tmp/remote_code_loader.lock | Threat hunters say the exfiltration has already fired if these files exist; the lock file means the backdoor daemon ran or is still running |
| 3 | Stop affected deployments; isolate and rebuild environments from clean backups | Just deleting the litellm directory may leave the startup files or an active loader behind — the official advice is to rebuild |
| 4 | Rotate every secret that lived in the environment — cloud keys, API tokens, registry credentials, private keys, and browser sessions | The stealer collected the full set; any secret that existed on the box must be treated as burned |
| 5 | Pin and reinstall the clean release: litellm==1.106.2 | 1.106.2 is the recommended recovery version; also verify companion packages are at the clean pins above |
Image: Wikimedia Commons / Kowalski7cc, CC0 — Illustrative image: engineers working on a Linux laptop
Why it matters for developers in India and worldwide
This attack pattern is becoming a signature of 2026: strike the build pipeline of a package the whole AI industry depends on. Python is the default language of AI development in India — from Bangalore startups to enterprise MLOps teams — and LiteLLM's one-API-for-every-model pitch makes it exactly the kind of dependency that ends up inside CI/CD systems, inference proxies and internal tools. A poisoned wheel of a package with ~92 million monthly downloads is not a niche developer headache; it is a credential breach at internet scale.
It also fits the month's bigger story. In the same week, Railway disclosed an intruder who may have decrypted customer environment variables — a reminder that AI-infrastructure providers are being hunted specifically. And our Python 3.15.1 security update guide covered how even the language runtime itself needed an emergency patch this month. Python shops should treat supply-chain hygiene — pinning exact versions, verifying hashes, and staging upgrades — as a first-class security control, the same way our Plex2Shell update guide argued for keeping home-lab software patched.
Should you care?
✅ Care urgently — today — if anything you run installed litellm==1.107.0 or pulled the tagged Docker images on 21 October: follow the checklist above in order, and rotate every secret in those environments. ⏳ Relax (but pin versions) if you only ever installed 1.106.2 or earlier, or versions below 1.107.0 — you were never exposed; treat this as the cheapest possible lesson in dependency pinning. The honest caveat: the investigation is still open and LiteLLM has not said how the engineers' tokens were first stolen, so expect a follow-up report.
FAQs
What happened to LiteLLM 1.107.0?
On 21 October 2026, attackers used stolen GitHub tokens to push a malicious 1.107.0 release of the popular Python AI-gateway package through LiteLLM's own release pipeline. The wheels on PyPI and Docker images carried a credential stealer and a backdoor for about two hours before being removed. LiteLLM says its private enterprise customers were not impacted.
How do I check if I installed the malicious LiteLLM version?
Check for exactly litellm==1.107.0 in your requirements and Docker image tags from 21 October. Threat hunters advise looking for the files /tmp/.pc_once_* and /tmp/remote_code_loader.lock — without launching Python, since starting the interpreter can trigger the malware. If either marker exists, treat the environment as compromised.
I installed litellm==1.107.0 — what should I do now?
Stop the deployment, isolate the environment and rebuild from a clean backup rather than just deleting the package, because startup files or the loader may remain. Rotate every cloud, AI, registry and SSH credential that existed in the environment, then reinstall the clean litellm==1.106.2. Review service logs for unusual activity in the same window.
Is LiteLLM safe to use now?
The poisoned release was quarantined on PyPI within about two hours and the malicious Docker images removed, so fresh installs of litellm==1.106.2 are the recommended clean state. But the incident is LiteLLM's second supply-chain compromise this year, and the root cause of the token theft is still unknown — so keep version pins tight and watch for LiteLLM's full post-mortem.
TAKEAWAY
A two-hour poisoned release of one of the world's most-installed Python AI packages put cloud, AI and browser credentials at risk everywhere it was installed. Check for 1.107.0, clean-rebuild anything it touched, rotate every secret, and pin 1.106.2.
Follow World Tech on TechByCountry for the next hourly update.
Sources: BleepingComputer — LiteLLM release pipeline hacked to distribute info-stealer malware (22 Oct 2026) • The Hacker News — LiteLLM Compromised in Supply Chain Attack (21 Oct 2026) • Datadog Security Labs — LiteLLM supply chain compromise (21 Oct 2026) • SafeDep — Compromised LiteLLM 1.107.0 • Upwind — LiteLLM 1.107.0 supply chain attack
Comments
Post a Comment