LiteLLM 1.107.0 hit by supply-chain attack; credential-stealing release pulled
Representative image: geralt / Pixabay
A malicious LiteLLM 1.107.0, pushed via a compromised pipeline on October 21, 2026, carried credential-stealing code; users should rotate keys.
What Happened
LiteLLM, a widely used open-source tool that lets software developers connect their applications to many different AI models through one interface, was hit by a supply-chain attack on Wednesday, October 21, 2026. According to the project's own incident notice, attackers compromised its release pipeline and published a malicious version, 1.107.0, to the Python Package Index (PyPI) and to its Docker image registries. The poisoned package was live on PyPI for about two hours, from 11:39 to 13:23 UTC, before it was pulled. Security firms that analysed it say it was built to steal cloud credentials, private keys and other secrets from developers' machines.
Key Facts
- The affected release is LiteLLM version 1.107.0, published on October 21, 2026.
- The project says its release pipeline was compromised, pushing the bad version to PyPI and to Docker images.
- On PyPI, the malicious version was available for about two hours (11:39 to 13:23 UTC) before removal.
- Security firm Wiz says LiteLLM Docker containers on GitHub's container registry and Docker Hub also carried the trojanised version, and that the most recent safe version is 1.106.2.
- Analyses by Socket and Upwind describe malicious files that run automatically when Python starts and that collect cloud credentials, private keys, browser data and login files for AI development tools.
- Socket noted that the release workflow referenced a look-alike source repository name differing by one hyphen from the real project.
- The project says previous versions are safe; this is separate from an earlier compromise of versions 1.82.7 and 1.82.8.
Why It Matters
Modern software is assembled from thousands of open-source building blocks, downloaded automatically from public registries such as PyPI. A supply-chain attack targets that trust: instead of breaking into one company, attackers poison a widely used package, and everyone who installs the update during the window gets the malicious code. Because LiteLLM sits in the middle of many AI applications, handling connections to different AI providers, the machines that run it often hold exactly the keys attackers want: access to cloud accounts and paid AI services.
The short window, about two hours on PyPI, limits the damage but does not remove it. Automated build systems can pull a new version within minutes of its release, and the Docker images may have been used for longer. Any company that rebuilt its software or containers during that period could have installed the bad version without anyone noticing. Stolen cloud credentials can then be used to run up bills, reach data or move deeper into a company's systems.
For Indian start-ups and developers, who build heavily on open-source AI tools, the incident is a practical warning. Teams that "pin" exact versions of their dependencies, rather than always taking the newest, and that review what changes before updating, are much less exposed to this kind of attack. It also shows why secrets should not sit in plain files on developer machines, and why access keys should be easy to rotate.
| What to do | Why |
|---|---|
| Check whether version 1.107.0 was installed anywhere | It is the malicious release |
| Pin to 1.106.2 or another verified earlier version | The project says earlier versions are safe |
| Rotate cloud, AI and other credentials on affected machines | The code was designed to steal them |
| Check Docker images built or pulled on October 21 | Container images were also affected |
Impact
Short-term: Developers and companies using LiteLLM need to check their systems, remove the bad version and change any credentials that may have been exposed. Security teams are likely to search logs for signs that stolen keys have been used.
Long-term: The attack adds to pressure on open-source projects to secure their release pipelines, for example through stricter controls on who and what can publish new versions, and on companies to verify the software they download.
Who is affected: Developers, start-ups and companies that use LiteLLM in their AI applications, particularly any that installed or built with version 1.107.0 on October 21; and the maintainers of the open-source project.
Key Takeaway
A malicious LiteLLM 1.107.0 release, published through a compromised pipeline on October 21, 2026, carried credential-stealing code; users should confirm they did not install it, pin a safe version and rotate exposed keys.
Questions and Answers
Which LiteLLM version was compromised on October 21, 2026?
Version 1.107.0. The LiteLLM project says its release pipeline was compromised and the malicious version was pushed to PyPI and Docker registries; on PyPI it was live for about two hours before being removed.
What did the malicious LiteLLM package do?
According to analyses by security firms Socket, Upwind and Wiz, it added files that run when Python starts and collect cloud credentials, private keys, browser data and login files for AI development tools.
What should LiteLLM users do now?
Check whether version 1.107.0 was installed or used in any Docker image, move to a verified safe version such as 1.106.2, and rotate any credentials that were present on affected machines.
Are earlier LiteLLM versions affected?
The project says previous versions are safe from this incident. A separate, earlier compromise affected versions 1.82.7 and 1.82.8, so users should check for both.
Disclaimer: Prepared by the Peepals newsroom from publicly available sources with AI assistance. Information is accurate to the best of our knowledge at the time of publication and may change. Images may be representative. Not professional advice. Report an error via our contact page.
Sourced and fact-checked by the Peepals Global Editorial Team
Reported, fact-checked and published by the Peepals Global Editorial Team.
