LiteLLM says compromised release distributed malware

LiteLLM is open-source software that lets users call and manage multiple AI models through a single interface.[2] LiteLLM says all seven PyPI wheels for version 1.107.0 were affected, and the malicious PyPI release was live from about 11:39 to 13:23 UTC on October 21.[1] On Docker Hub, the v1.107.0, latest, main-latest and main-stable tags pointed to a compromised image.[1] LiteLLM says the same four GHCR tags pointed to compromised images from 11:46:56 UTC until they were made unavailable by 13:51 UTC.[1]

LiteLLM says the malicious code harvested credentials and included tools for remote-code execution.[1] Datadog says the infostealer targeted cloud, developer, AI-tool, browser and LiteLLM proxy credentials.[3] Microsoft says the package could run when Python started in an affected environment, even if the application did not import LiteLLM.[4] Microsoft also described a separate database module that tried to read selected credential and model-configuration records from LiteLLM’s proxy.[4] Datadog says the stolen data was encrypted and sent to the lookalike domain litellm.dev/healthcheck, and that no second-stage payload was observed in the wild.[3]

LiteLLM says a public repository commit on May 27, 2026, inadvertently exposed an administrative key to an internal deployment; the key was not revoked and remained valid more than four months later.[5] LiteLLM says its normal pipeline built, signed and published attacker-controlled source using its own signing key and Trusted Publisher identity.[6] The company says the malicious packages have been removed from PyPI, Docker Hub and GHCR.[1]

LiteLLM advises users to pin to version 1.106.2 or an earlier explicit release.[1] It says exposed API keys, cloud credentials and developer-tool tokens must be revoked and reissued.[2] Because Python startup files can run again whenever Python starts, including when running pip, teams should account for that behavior when checking affected environments.[1] LiteLLM says previous releases were safe and its private enterprise release was not affected; it also says the official GitHub source tag for v1.107.0 did not contain the malicious files because compromised artifacts were built from an attacker-controlled repository.[1] Datadog described this as LiteLLM’s second supply-chain compromise in 2026, while saying no connection to the earlier incident had been established at the time of writing.[3]